United States

Executive Order 13960 was issued on December 3, 2020 under the title Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government. Section 3 establishes Principles for the use of AI in the Federal Government for purposes other than national security and defense.

When designing, developing, acquiring, and using AI in the Federal Government, agencies must adhere to the nine Principles: lawful and respectful of the Nation's values, purposeful and performance-driven, accurate, reliable and effective, safe, secure and resilient, understandable, responsible and traceable, regularly monitored, transparent, and accountable.

Within 180 days of the date of the CIO Council's completion of its criteria, and annually thereafter, each agency must prepare an inventory of its non-classified and non-sensitive use cases of AI, including current and planned uses. Within 120 days of completing its inventory, each agency must develop plans either to achieve consistency with the order for each AI application or to retire AI applications developed or used in a manner that is not consistent with it.

Within 120 days of completing their inventories, agencies must make them available to the public, to the extent practicable and in accordance with applicable law and policy. Within 30 days of the date of the order, each agency must specify the responsible official or officials who will coordinate implementation of the Principles. The term agency covers all agencies described in section 3502(1) of title 44 of the United States Code, except the agencies described in subsection (5) of that section.

The order applies to agencies that have use cases for AI within its scope, and excludes the Department of Defense and those agencies and agency components with functions that lie wholly within the Intelligence Community. The order applies to both existing and new uses of AI, to AI developed by the agency or by third parties on behalf of agencies for specific agency missions, and to agencies' procurement of AI applications.

The order does not apply to AI used in defense or national security systems, to AI embedded within common commercial products such as word processors or map navigation systems, or to AI research and development activities. The order creates no right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States. Executive Order 14319 of July 23, 2025 states that it builds on this order.

OMB Memorandum M-25-21 of April 3, 2025 directs agencies to ensure their AI use is trustworthy, secure, and accountable, in accordance with this order. OMB Memorandum M-26-04 of December 11, 2025 states that its guidance builds on existing directives and policies that address agencies' acquisition and use of AI, such as this order.

Executive Order 14319 was issued on July 23, 2025 under the title Preventing Woke AI in the Federal Government. Executive Order 14319 builds on Executive Order 13960 of December 3, 2020 for large language models. Agency heads must, consistent with applicable law and in consideration of OMB guidance, procure only those large language models developed in accordance with two principles, the Unbiased AI Principles.

Under the Truth-seeking principle, a large language model must be truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, and acknowledge uncertainty where reliable information is incomplete or contradictory.

Under the Ideological Neutrality principle, a large language model must be a neutral, nonpartisan tool that does not manipulate responses in favor of ideological dogmas, and developers must not intentionally encode partisan or ideological judgments into its outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Within 120 days of the order, the Director of the Office of Management and Budget, in consultation with the Administrator for Federal Procurement Policy, the Administrator of General Services, and the Director of the Office of Science and Technology Policy, must issue guidance to agencies to implement section 3.

The OMB guidance required by section 4(a) must permit vendors to comply with the second principle through disclosure of the system prompt, specifications, evaluations, or other relevant documentation, and avoid requiring disclosure of specific model weights or other sensitive technical data where practicable. The OMB guidance required by section 4(a) must also make exceptions as appropriate for the use of large language models in national security systems.

To the maximum extent consistent with applicable law, each agency head must include in each Federal contract for a large language model entered into after the date of the OMB guidance terms requiring that the procured model comply with the Unbiased AI Principles, and providing that decommissioning costs are charged to the vendor if the agency terminates for the vendor's noncompliance following a reasonable period to cure.

Each agency head must, to the extent practicable and consistent with contract terms, revise existing contracts for large language models to include those terms. Within 90 days of the OMB guidance, each agency head must adopt procedures to ensure that large language models procured by the agency comply with the Unbiased AI Principles. The order creates no right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States.

OMB Memorandum M-26-04, dated December 11, 2025, states that it implements section 4 of the order. OMB Memorandum M-26-04 requires each agency to ensure that any solicitation or order for procurement of a large language model that the agency issues after the date of the memorandum includes contractual requirements addressing compliance with the Unbiased AI Principles.

OMB Memorandum M-26-04 also requires each agency to update its policies and procedures no later than March 11, 2026 so that contracts for the procurement of large language models include those contractual requirements. In solicitations for large language models, an agency must request an acceptable use policy from the vendor. An agency must also request model, system or data cards, end user resources, and a mechanism for end user feedback.

An agency must also request information regarding development and operation of a large language model when the model is integrated into another software product or service to be procured. An agency should explicitly identify the relevant requirements as material to eligibility and payment under the contract, to support termination of the contract for default where the vendor refuses to take corrective action.

OMB Memorandum M-26-04 does not apply to national security systems, and it excludes AI used incidentally by a contractor during performance of a contract for administrative purposes. OMB Memorandum M-26-04 ceases to have any force or effect two years after the date of its issuance, unless the Director of OMB provides otherwise.

The memorandum, addressed to the heads of executive departments and agencies, is dated April 3, 2025. The memorandum rescinds and replaces an earlier OMB memorandum. Except as specifically noted, the memorandum applies to all agencies defined in 44 U.S.C. 3502(1). Some requirements apply only to Chief Financial Officers Act agencies, and other requirements do not apply to elements of the Intelligence Community.

The memorandum does not cover AI when it is being used as a component of a National Security System. The memorandum states that it governs only agencies' own use of AI and does not create rights or obligations for the public. The memorandum's requirements and recommendations apply to new and existing AI that is developed, used, or acquired by or on behalf of covered agencies. Within 60 days of its issuance, the head of each agency must retain or designate a Chief AI Officer.

Within 90 days, each CFO Act agency must convene its relevant agency officials to coordinate and govern issues related to the use of AI within the Executive Branch, and may rely on an existing governance body to do so. Within 180 days, each CFO Act agency must develop an AI strategy for identifying and removing barriers to its responsible use of AI. Each agency, except the Department of Defense and the Intelligence Community, must inventory its AI use cases at least annually.

Within 180 days of the memorandum's issuance, and every two years thereafter until 2036, each agency must submit a compliance plan, or a written determination that it does not use and does not anticipate using covered AI, to OMB and post it publicly. Within 365 days of the memorandum's issuance, agencies must document implementation of the minimum practices in Section 4(b) for high-impact uses of AI.

If a high-impact use case does not comply with the minimum practices, the agency must safely discontinue use of the AI functionality.

High-impact AI is AI with an output that serves as a principal basis for decisions or actions with legal, material, binding, or significant effect on civil rights, civil liberties or privacy; access to education, housing, insurance, credit, employment and other programs; access to critical government resources or services; human health and safety; critical infrastructure or public safety; or strategic assets or resources.

Section 6 lists categories of agency uses of AI that are presumed to be high-impact. The presumed categories include safety-critical functions of critical infrastructure or government facilities, emergency services, fire and life safety systems within structures, food safety mechanisms, and traffic control systems. The presumed categories also include risk assessments about individuals, the identification of criminal suspects and the forecast of crime in law enforcement contexts.

The presumed categories also include the preparation or adjudication of risk assessments related to foreign nationals seeking temporary or permanent access to the United States, including for immigration, asylum, detention or travel approval. The presumed categories also include the ability to apply for, or the adjudication of, requests for critical federal services, processes and benefits, including loans and access to public housing.

The presumed categories also include the determination of the terms or conditions of Federal employment. For a use case in those categories, an appropriate agency official must submit written documentation to notify the Chief AI Officer when determining that the use case does not meet the definition of high-impact. Agencies must develop pre-deployment testing and prepare risk mitigation plans that reflect expected real-world outcomes and identify expected benefits to the AI use.

If an agency does not have access to the underlying AI source code, models, or data, it must use alternative test methodologies, such as querying the AI service and observing the outputs or providing evaluation data to the vendor and obtaining results. Agencies must complete an AI impact assessment before deploying any high-impact AI use case.

The AI impact assessment must be documented and updated periodically throughout the AI's lifecycle, and must address at a minimum the intended purpose and expected benefit, the quality and appropriateness of the data and model capability, the potential impacts on privacy, civil rights and civil liberties, reassessment scheduling, related costs, the results of independent review, and risk acceptance supported by a signature.

Agencies must conduct testing and periodic human review of AI use cases, where feasible, to identify adverse impacts to the performance and security of AI functionality, including those that may violate laws governing privacy, civil rights, or civil liberties. Agencies must ensure there is sufficient and periodic training, assessment, and oversight for operators of AI to interpret and act on the AI's output and manage associated risks.

Agencies must ensure human oversight, intervention, and accountability suitable for high-impact use cases. Agencies must ensure that individuals affected by AI-enabled decisions have access to a timely human review and a chance to appeal any negative impacts, when appropriate. Agencies must provide an option for end users and the public to submit feedback on the use case, where appropriate, and use that feedback to inform agency decision-making regarding the AI.

A pilot program for a proposed AI use case is exempt from the minimum risk management practices if the program is of limited scale and duration and the agency Chief AI Officer has certified that the pilot may go forward, with that certification tracked centrally. The pilot must also, when possible, let individuals who may interact with the AI opt into and out of participating, with sufficient notice to make an informed decision, and apply the minimum risk management practices where practicable.

An agency Chief AI Officer may waive one or more of the Section 4 requirements for a specific covered AI application or component after a written determination, based on a system-specific and context-specific risk assessment, that fulfilling the requirement would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations.

The Chief AI Officer must certify the ongoing validity of each waiver annually, may revoke a waiver at any time, and may not delegate that responsibility to other officials. Chief AI Officers must centrally track waivers, reassess them if there are significant changes to the conditions or context in which the AI is used, and within 30 days of granting or revoking a waiver report its scope, justification and supporting evidence to OMB.

To the extent consistent with law and governmentwide policy, each agency must publicly release a summary describing each individual determination and waiver and its justification, or publicly indicate that it has no active determinations or waivers. Contract terms should protect agency data from unauthorized disclosure or use, and from being used to train or improve the functionality of a vendor's commercial offerings without express permission from the agency.

A footnote states that its requirements are consistent with the AI in Government Act of 2020, the Advancing American AI Act, Executive Order 13960 and Executive Order 14179.

The memorandum, addressed to the heads of executive departments and agencies, is dated April 3, 2025. It rescinds and replaces an earlier OMB memorandum. Except as specifically noted, it applies to all agencies defined in 44 U.S.C. 3502(1). It does not apply to elements of the Intelligence Community. It does not apply to AI acquired for use as a component of a National Security System.

It applies to any contract awarded under a solicitation issued on or after the date 180 days after its issuance, and to any option to renew or extend a contract exercised after that date. Agencies must include appropriate contractual terms that clearly delineate the respective ownership and intellectual property rights of the government and the contractor.

Agency processes should ensure that contracts permanently prohibit the use of non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent. For AI systems with potential or expected high-impact use cases, agencies must inform vendors of reasonable transparency and documentation requirements that will be placed on the vendor.

Where applicable, agencies must include in contracts for AI systems and services terms that address a listed set of subjects. Contracts must ensure compliance with minimum risk management practices for high-impact use cases. Contractual terms must provide the contracting agency the ability to regularly monitor and evaluate the performance, risks, and effectiveness of an AI system or service. Vendors must provide the access and time necessary for agencies to complete independent evaluation.

Contracts must detail the examination, testing, and validation procedures of the vendor and must not prohibit agencies from internally disclosing how the vendor conducts testing or the results of testing. Terms on protections against vendor lock-in are necessary to reduce the risk that switching vendors could become cost-prohibitive. Agencies must determine whether circumstances merit a solicitation provision requiring disclosure of AI use as part of a contract's performance. The memorandum is directed to agencies, which reach a vendor through the terms they include in a contract.

The Federal Trade Commission's Rule on Impersonation of Government and Businesses, 16 CFR part 461, prohibits materially and falsely posing, directly or by implication, as a government entity or officer thereof, in or affecting commerce. It prohibits materially misrepresenting, directly or by implication, affiliation with, including endorsement or sponsorship by, a government entity or officer thereof.

It prohibits materially and falsely posing, directly or by implication, as a business or officer thereof, and materially misrepresenting affiliation with a business or officer thereof. A business under the rule is any entity that provides goods or services, including not-for-profit entities. A violation of the rule is an unfair or deceptive act or practice. The rule took effect on April 1, 2024. The Commission stated that the rule enables it to obtain civil penalties against violators.

The Commission decided not to finalize a proposed provision on providing the means and instrumentalities of impersonation. On October 1, 2026 the Commission proposed to commence a rulemaking proceeding on unfair or deceptive acts or practices by search engine, social media, and other digital marketplace platforms that further government and business impersonation scams.

Section 1466A makes it an offense, in a circumstance described in subsection (d), knowingly to produce, distribute, receive, or possess with intent to distribute a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that depicts a minor engaging in sexually explicit conduct and is obscene.

The circumstances in subsection (d) include that a communication involved in or made in furtherance of the offense is communicated or transported by the mail, or in interstate or foreign commerce by any means, including by computer. For this section, a visual depiction includes a computer image or picture, or computer generated image or picture, whether made or produced by electronic, mechanical, or other means.

A second limb reaches an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse and lacks serious literary, artistic, political, or scientific value. Subsection (b) separately makes knowing possession of either kind of depiction an offense. The section provides that it is not a required element of any offense under it that the minor depicted actually exist.

Section 2256(8) defines child pornography to include a visual depiction that is a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct.

For that definition, indistinguishable means virtually indistinguishable, in that an ordinary person viewing the depiction would conclude that it is of an actual minor engaged in sexually explicit conduct, and the definition does not apply to drawings, cartoons, sculptures, or paintings. The same definition also reaches a visual depiction that has been created, adapted, or modified to appear that an identifiable minor is engaging in sexually explicit conduct. Possession under subsection (b) is subject to the penalties of section 2252A(b)(2).

It is unlawful for any person, in interstate or foreign commerce, to use an interactive computer service to knowingly publish a digital forgery of an identifiable individual who is not a minor, where the forgery is published without the individual's consent, what is depicted was not voluntarily exposed in a public or commercial setting and is not a matter of public concern, and the publication is intended to cause harm or causes harm.

A digital forgery is an intimate visual depiction of an identifiable individual created through the use of software, machine learning, artificial intelligence, or any other computer-generated or technological means that a reasonable person would find indistinguishable from an authentic visual depiction of the individual.

The prohibition also covers publishing a digital forgery of an identifiable minor with intent to abuse, humiliate, harass or degrade the minor, or to arouse or gratify the sexual desire of any person. A violation involving an adult is punishable by a fine, imprisonment of not more than 2 years, or both. A violation involving a minor is punishable by a fine, imprisonment of not more than 3 years, or both.

A person who intentionally threatens to publish a digital forgery of an adult for the purpose of intimidation, coercion, extortion, or to create mental distress is punishable by a fine, imprisonment of not more than 18 months, or both.

Section 1020.320 of title 31 requires every bank to file with the Treasury Department, to the extent and in the manner the section requires, a report of any suspicious transaction relevant to a possible violation of law or regulation.

Section 1010.100 of title 31 defines a bank to include each agent, agency, branch or office within the United States of a person doing business as a commercial bank or trust company, a private bank, a savings and loan association or building and loan association, an insured institution, a savings bank, industrial bank or other thrift institution, or a credit union, among the capacities the definition lists.

A transaction requires reporting if it is conducted or attempted by, at, or through the bank, involves or aggregates at least $5,000 in funds or other assets, and the bank knows, suspects, or has reason to suspect one of three listed conditions.

The three conditions are that the transaction involves funds derived from illegal activities or is intended or conducted to hide or disguise funds or assets derived from illegal activities as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation, that it is designed to evade any requirement of the Bank Secrecy Act regulations, or that it has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage and the bank knows of no reasonable explanation after examining the available facts.

A bank is required to file a SAR, short for Suspicious Activity Report, no later than 30 calendar days after the date of initial detection by the bank of facts that may constitute a basis for filing a SAR. If no suspect was identified on the date of the detection, a bank may delay filing a SAR for an additional 30 calendar days to identify a suspect, and in no case may reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction.

Where a violation requires immediate attention, such as an ongoing money laundering scheme, the bank shall immediately notify an appropriate law enforcement authority by telephone in addition to filing a SAR on time. A bank is not required to file a SAR for a robbery or burglary committed or attempted that is reported to appropriate law enforcement authorities, or for lost, missing, counterfeit, or stolen securities with respect to which the bank files a report under 17 CFR 240.17f-1.

A bank shall maintain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR. Supporting documentation is deemed to have been filed with the SAR, and the bank shall make all of it available upon request to FinCEN, to any Federal, State, or local law enforcement agency, and to the regulatory authorities the section names.

A SAR, and any information that would reveal the existence of a SAR, are confidential and may not be disclosed except as paragraph (e) of the section authorizes. No bank, and no director, officer, employee, or agent of any bank, may disclose a SAR or any information that would reveal the existence of a SAR.

A bank, or a director, officer, employee, or agent of a bank, that is subpoenaed or otherwise requested to disclose a SAR or such information shall decline to produce it, citing the section and the statute, and shall notify FinCEN of the request and the response.

Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, the prohibition does not bar a bank from disclosing a SAR, or information that would reveal its existence, to FinCEN, to any Federal, State, or local law enforcement agency, to a Federal regulatory authority that examines the bank for compliance with the Bank Secrecy Act, or to a State regulatory authority administering a State law that requires the bank to comply with the Bank Secrecy Act.

On the same condition, the prohibition does not bar disclosing the underlying facts, transactions, and documents upon which a SAR is based, including to another financial institution for the preparation of a joint SAR and in certain employment references or termination notices.

On the same condition, the prohibition does not bar a bank from sharing a SAR, or information that would reveal its existence, within the bank's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.

Section 5318(g)(1) of title 31 authorizes the Secretary of the Treasury to require any financial institution, and any director, officer, employee, or agent of a financial institution, to report any suspicious transaction relevant to a possible violation of law or regulation.

Under section 5318(g)(2)(A) of title 31, once a financial institution reports a suspicious transaction to a government agency, neither the institution, nor any of its directors, officers, employees or agents, nor any other current or former director, officer, or employee of, or contractor for, the institution, may notify any person involved in the transaction that the transaction has been reported or otherwise reveal any information that would reveal that the transaction has been reported.

A domestic financial institution, and a partner, director, officer, or employee of one, that willfully violates the Bank Secrecy Act subchapter or a regulation under it is liable to the United States Government for a civil penalty of not more than the greater of the amount, not to exceed $100,000, involved in the transaction or $25,000.

The Secretary of the Treasury may impose a civil money penalty of not more than $500 on a financial institution that negligently violates the subchapter or a regulation under it, and, for a pattern of negligent violations, a further penalty of not more than $50,000.

The inflation adjustment table in the July 1, 2025 edition of title 31 of the Code of Federal Regulations replaces the statutory range of $25,000 to $100,000 for willful violations with a range of $71,545 to $286,184 for penalties assessed on or after January 17, 2025. A person who willfully violates the subchapter or a regulation under it shall be fined not more than $250,000, imprisoned for not more than five years, or both.

Where the willful violation occurs while violating another law of the United States or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the penalty is a fine of not more than $500,000, imprisonment for not more than 10 years, or both. Banks shall be examined by FinCEN or its delegatees for compliance with the section.

FinCEN's filing instructions list the parallel duty to file a SAR for casinos and card clubs, money services businesses, brokers or dealers in securities, mutual funds, insurance companies, futures commission merchants and introducing brokers in commodities, and residential mortgage lenders and originators, in sections 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320 and 1029.320 of title 31.

FinCEN moved the Bank Secrecy Act regulations to a new chapter of the Code of Federal Regulations by a final rule effective March 1, 2011. FinCEN's rule requiring banks to report suspicious transactions, first codified as 31 CFR 103.21, became effective on April 1, 1996.

Section 1691(d)(1) of title 15 requires a creditor to notify an applicant of its action on a completed application for credit within thirty days after receiving it, or within a longer reasonable time that the regulations of the Consumer Financial Protection Bureau specify for a class of credit transaction.

An applicant against whom adverse action is taken is entitled to a statement of reasons, which the creditor satisfies by providing statements of reasons in writing as a matter of course, or by giving written notification that discloses the applicant's right to a statement of reasons within thirty days after the creditor receives a request made within sixty days after the notification and the identity of the person or office from which the statement may be obtained.

A statement of reasons meets the requirements of section 1691(d) only if it contains the specific reasons for the adverse action taken. Regulation B requires the statement of reasons for adverse action to be specific and to indicate the principal reasons for the adverse action, and says that a statement that the action was based on the creditor's internal standards or policies, or that the applicant failed to achieve a qualifying score on the creditor's credit scoring system, is insufficient.

Regulation B requires a notice of adverse action to be in writing and to contain a statement of the action taken, the name and address of the creditor, a statement of the provisions of section 701(a) of the Act, the name and address of the Federal agency that administers compliance with respect to the creditor, and either a statement of specific reasons or a disclosure of the applicant's right to a statement of specific reasons within 30 days if the statement is requested within 60 days of the creditor's notification.

Under the official interpretation of Regulation B, the specific reasons disclosed must relate to and accurately describe the factors actually considered or scored by a creditor. The official interpretation also says that where a creditor bases a denial or other adverse action on a credit scoring system, the reasons disclosed must relate only to the factors actually scored in the system, and no factor that was a principal reason for adverse action may be excluded from disclosure.

Regulation B requires notice of action taken within 30 days after receiving a completed application, within 30 days after taking adverse action on an incomplete application unless a notice of incompleteness is provided, within 30 days after taking adverse action on an existing account, and within 90 days after notifying the applicant of a counteroffer that the applicant does not expressly accept or use.

For a business with gross revenues in excess of $1 million in its preceding fiscal year, and for trade credit, credit incident to a factoring agreement and similar business credit, Regulation B requires a creditor to notify the applicant of the action taken within a reasonable time and to provide a written statement of the reasons and the Equal Credit Opportunity Act (ECOA) notice if the applicant makes a written request for the reasons within 60 days of the creditor's notification.

A creditor that did not act on more than one hundred and fifty applications during the calendar year before the calendar year of the adverse action may satisfy the requirements of paragraphs (2), (3) and (4) of section 1691(d) by verbal statements or notifications, as determined under regulations of the Bureau.

The Act defines a creditor as any person who regularly extends, renews, or continues credit, any person who regularly arranges for the extension, renewal, or continuation of credit, or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit. Regulation B defines a creditor as a person who, in the ordinary course of business, regularly participates in a credit decision, including setting the terms of the credit.

Regulation B excludes from the term creditor a person whose only participation in a credit transaction involves honoring a credit card.

The Act defines adverse action as a denial or revocation of credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in substantially the amount or on substantially the terms requested, and excludes a refusal to extend additional credit under an existing credit arrangement where the applicant is delinquent or otherwise in default, or where the additional credit would exceed a previously established credit limit.

A creditor that fails to comply with a requirement of the Act is liable to the aggrieved applicant for any actual damages sustained, whether the applicant acts in an individual capacity or as a member of a class. A creditor other than a government or governmental subdivision or agency is also liable for punitive damages of not more than $10,000, and in a class action the total recovery of punitive damages cannot exceed the lesser of $500,000 or 1 per centum of the net worth of the creditor.

A successful action carries the costs of the action and a reasonable attorney's fee as determined by the court. A civil action under the Act may not be brought later than 5 years after the date of the occurrence of the violation, except that an applicant who is a victim of the discrimination that is the subject of an agency enforcement proceeding or an Attorney General civil action begun within the five years may sue not later than one year after that proceeding or action begins.

No provision of the Act imposing liability applies to an act done or omitted in good faith in conformity with an official rule, regulation, or interpretation of the Bureau. Under Regulation B, a creditor's failure to comply with section 1002.9 is not a violation if it results from an inadvertent error, and on discovering the error the creditor shall correct it as soon as possible.

The official interpretation lists clerical mistake, calculation error, computer malfunction and printing error among inadvertent errors, and says an error of legal judgment is not an inadvertent error. The Consumer Financial Protection Bureau enforces the Act with respect to any person subject to it, under subtitle E of the Consumer Financial Protection Act of 2010.

Except to the extent that enforcement is specifically committed to another agency under paragraphs (1) through (8) of subsection (a) of the enforcement section, and subject to subtitle B of the Consumer Financial Protection Act of 2010, the Federal Trade Commission is authorized to enforce the Act's requirements.

The Consumer Financial Protection Bureau published Regulation B as part 1002 of title 12 of the Code of Federal Regulations by an interim final rule effective December 30, 2011, and the rule imposed no new substantive obligations on persons subject to the earlier Regulation B published by the Board of Governors of the Federal Reserve System.

Rule 17a-4 applies to a member of a national securities exchange who transacts a business in securities directly with others than members of a national securities exchange, to a broker or dealer who transacts a business in securities through the medium of such a member, and to a broker or dealer registered under section 15 of the Exchange Act, including a security-based swap dealer or major security-based swap participant that is also a registered broker or dealer.

Rule 18a-6 applies instead of Rule 17a-4 to a security-based swap dealer or major security-based swap participant that is not also a broker or dealer. A member, broker or dealer subject to Rule 17a-3 must preserve for not less than six years, the first two years in an easily accessible place, the records Rule 17a-3(a)(1) through (3), (5), (21) and (22) require.

A member, broker or dealer subject to Rule 17a-3 must preserve for not less than three years, the first two years in an easily accessible place, the records listed in paragraph (b). Paragraph (b)(4) covers originals of all communications received and copies of all communications sent (and any approvals thereof) relating to the business as such, including all communications which are subject to rules of a self-regulatory organization regarding communications with the public.

A member, broker or dealer must preserve account cards and records relating to the terms and conditions of opening and maintaining a customer's account for not less than six years after the account is closed. Records may be maintained and preserved by means of an electronic recordkeeping system or micrographic media, subject to the conditions in paragraph (f).

An electronic recordkeeping system must either preserve a record for the duration of its retention period in a manner that maintains a complete time-stamped audit trail, or preserve the records exclusively in a non-rewriteable, non-erasable format. An electronic recordkeeping system must verify automatically the completeness and accuracy of the processes for storing and retaining records electronically.

An electronic recordkeeping system must have the capacity to readily download and transfer copies of a record and its audit trail (if applicable) in both a human readable format and a reasonably usable electronic format.

A broker or dealer using an electronic recordkeeping system must at all times have available, for examination by the staffs of the Commission, the self-regulatory organizations of which it is a member, or any State securities regulator having jurisdiction, facilities for immediately producing the records preserved by the system and for producing copies of them.

A broker or dealer using an electronic recordkeeping system must have at all times filed with its designated examining authority undertakings signed by either a designated executive officer or a designated third party.

If the records are prepared or maintained by an outside service bureau, depository, bank, or other recordkeeping service, that outside entity must file with the Commission a written undertaking, signed by a duly authorized person, that the records are the property of the member, broker or dealer and will be surrendered promptly on request.

An agreement with an outside entity does not relieve the member, broker or dealer from the responsibility to prepare and maintain records as specified in Rule 17a-4 or Rule 17a-3.

Every member, broker and dealer subject to the rule must furnish promptly to a representative of the Commission legible, true, complete, and current copies of the records required to be preserved under the rule, or any other records subject to examination under section 17(b) of the Exchange Act that the representative requests. The Commission's 2022 amendments to Rule 17a-4 took effect on January 3, 2023, and the compliance date for those amendments was May 3, 2023.

The rule's source note cites its original publication at 13 FR 8212 on December 22, 1948. The Commission may bring an action in the proper district court of the United States to enjoin acts or practices that violate the Exchange Act or any rule or regulation under it.

Section 201(h) of the Federal Food, Drug, and Cosmetic Act, which defines a device, states that the term does not include software functions excluded under section 520(o).

Section 520(o)(1)(A) excludes a software function intended for administrative support of a health care facility, including the processing and maintenance of financial records, claims or billing information, appointment schedules, business analytics, information about patient populations, admissions, practice and inventory management, analysis of historical claims data to predict future utilization or cost-effectiveness, determination of health benefit eligibility, population health management, and laboratory workflow.

Section 520(o)(1)(B) excludes a software function intended for maintaining or encouraging a healthy lifestyle that is unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition. Section 520(o)(1)(C) excludes a software function that serves as electronic patient records, to the extent the records are intended to transfer, store, convert formats, or display the equivalent of a paper medical chart.

The electronic-records exclusion applies only if the function is not intended to interpret or analyze patient records, including medical image data, for the purpose of the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition.

Section 520(o)(1)(D) excludes a software function for transferring, storing, converting formats, or displaying clinical laboratory test or other device data and results, findings by a health care professional about that data, general information about those findings, and general background information about the laboratory test or other device.

The data-display exclusion does not cover a function intended to interpret or analyze clinical laboratory test or other device data, results, and findings. Section 520(o)(1)(E), the clinical decision support exclusion, does not cover a function intended to acquire, process, or analyze a medical image or a signal from an in vitro diagnostic device or a pattern or signal from a signal acquisition system.

The clinical decision support exclusion reaches a function intended for supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition.

It also requires that the function enable the health care professional to independently review the basis for the recommendations so that it is not the intent that the professional rely primarily on any of them to make a clinical diagnosis or treatment decision regarding an individual patient.

For a product with an excluded software function and a function that meets the device definition, the Secretary shall not regulate the excluded software function as a device, but may assess its impact on the device function when assessing the device function's safety and effectiveness.

A software function described in paragraph (1)(C), (D), or (E) is not excluded from the device definition if the Secretary finds that its use would be reasonably likely to have serious adverse health consequences and identifies it in a final order issued after notice in the Federal Register and a comment period of not less than 30 calendar days.

Nothing in section 520(o) limits the Secretary's authority to regulate software as a device if the software meets the criteria under section 513(a)(1)(C). The provision narrows the definition of device in section 201(h) and sets no duty of its own.

A person required to register who proposes to begin introducing a device intended for human use into interstate commerce for commercial distribution must, at least ninety days beforehand, report to the Secretary or an accredited person the class in which the device is classified and the action taken to comply with the requirements of section 514 or 515 that apply to it.

A class III device that is subject to a premarket approval order, or is class III by operation of section 513(f), must have an approved application for premarket approval unless exempt under section 520(g). Section 301(a) prohibits the introduction or delivery for introduction into interstate commerce of a device that is adulterated or misbranded.

A person who violates section 301 shall be imprisoned for not more than one year or fined not more than $1,000, or both, and for a repeat violation or one committed with intent to defraud or mislead, imprisoned for not more than three years or fined not more than $10,000, or both. Proceedings for the enforcement of the Act, or to restrain violations of it, are brought by and in the name of the United States. Section 3060(a) of Public Law 114-255 added subsection (o) to section 520. Public Law 114-255 was enacted on December 13, 2016.

FINRA Rule 2210 defines communications as correspondence, retail communications and institutional communications. A retail communication is any written (including electronic) communication that is distributed or made available to more than 25 retail investors within any 30 calendar-day period. Correspondence is any written (including electronic) communication that is distributed or made available to 25 or fewer retail investors within any 30 calendar-day period.

An appropriately qualified registered principal of the member must approve each retail communication before the earlier of its use or filing with FINRA's Advertising Regulation Department.

The approval requirement does not apply to certain retail communications, including one posted on an online interactive electronic forum and one that makes no financial or investment recommendation and does not promote a product or service of the member, if the member supervises and reviews it as it does correspondence.

All member communications must be based on principles of fair dealing and good faith, must be fair and balanced, and must provide a sound basis for evaluating the facts in regard to any particular security or type of security, industry, or service. No member may make any false, exaggerated, unwarranted, promissory or misleading statement or claim in any communication.

Communications may not predict or project performance, imply that past performance will recur or make any exaggerated or unwarranted claim, opinion or forecast, with listed exceptions that include an investment analysis tool meeting the requirements of Rule 2214. Members must maintain all retail communications and institutional communications for the retention period required by SEA Rule 17a-4(b) and in a format and media that comply with SEA Rule 17a-4.

Regulatory Notice 12-29 reports that the Securities and Exchange Commission approved the new rules governing communications with the public. The communications rules, including Rule 2210, became effective on February 4, 2013. Section 78o-3 of title 15 requires the rules of a national securities association to provide that its members and persons associated with its members shall be appropriately disciplined for violation of the rules of the association.

FINRA may impose sanctions on a member or person associated with a member for each violation of FINRA rules, from censure and a fine to expulsion and a bar from association with all members.

FINRA Rule 3110 requires each member to establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations and with applicable FINRA rules. Each member must also establish, maintain, and enforce written procedures to supervise the types of business in which it engages and the activities of its associated persons.

Those procedures must include procedures for the review of incoming and outgoing written (including electronic) correspondence and internal communications relating to the member's investment banking or securities business, appropriate for the member's business, size, structure, and customers. A registered principal must conduct the review of correspondence and internal communications and evidence it in writing, either electronically or on paper.

Merely opening a communication is not sufficient review. A supervisor or principal may delegate certain review functions to persons who need not be registered but remains ultimately responsible for the performance of all necessary supervisory reviews. Each member must retain the internal communications and correspondence of associated persons relating to its investment banking or securities business for the period of time and accessibility specified in SEA Rule 17a-4(b).

Each member must conduct a review, at least annually on a calendar-year basis, of the businesses in which it engages. The Commission approved FINRA's new consolidated rules governing supervision, of which Rule 3110 is one. The new supervision rules became effective on December 1, 2014.

Section 78o-3 of title 15 requires the rules of a national securities association to provide that its members and persons associated with its members shall be appropriately disciplined for violation of the rules of the association. FINRA may impose sanctions on a member or person associated with a member for each violation of FINRA rules, from censure and a fine to expulsion and a bar from association with all members.

FINRA Rule 4511 requires members to make and preserve books and records as required under the FINRA rules, the Exchange Act and the applicable Exchange Act rules. Members must preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules. All books and records required to be made under the FINRA rules must be preserved in a format and media that complies with SEA Rule 17a-4.

The Commission approved FINRA's proposal to adopt rules governing books and records for the consolidated FINRA rulebook, among them Rule 4511. The new books and records rules took effect on December 5, 2011. The rulebook records that Rule 4511 was adopted by SR-FINRA-2010-052, effective December 5, 2011.

Section 78o-3 of title 15 requires the rules of a national securities association to provide that its members and persons associated with its members shall be appropriately disciplined for violation of the rules of the association. FINRA may impose sanctions on a member or person associated with a member for each violation of FINRA rules, from censure and a fine to expulsion and a bar from association with all members.

Section 206 of the Investment Advisers Act makes it unlawful for any investment adviser, by use of the mails or any means or instrumentality of interstate commerce, directly or indirectly, to employ any device, scheme, or artifice to defraud any client or prospective client. Section 206 also makes it unlawful for an investment adviser to engage in any transaction, practice, or course of business which operates as a fraud or deceit upon any client or prospective client.

It further bars an investment adviser, acting as principal for its own account, from knowingly selling any security to or purchasing any security from a client, and bars an adviser acting as broker for a person other than the client from knowingly effecting a sale or purchase of any security for the client's account, in either case without disclosing to the client in writing before completion of the transaction the capacity in which it is acting and obtaining the client's consent.

The prohibitions of that paragraph do not apply to any transaction with a customer of a broker or dealer if the broker or dealer is not acting as an investment adviser in relation to the transaction. Section 206 also makes it unlawful for an investment adviser to engage in any act, practice, or course of business which is fraudulent, deceptive, or manipulative, and the Commission defines such acts, practices, and courses of business by rule.

An investment adviser is any person who, for compensation, engages in the business of advising others, either directly or through publications or writings, as to the value of securities or as to the advisability of investing in, purchasing, or selling securities, or who, for compensation and as part of a regular business, issues or promulgates analyses or reports concerning securities.

The definition does not include, among others, a bank (with an exception for a bank acting as adviser to a registered investment company), a lawyer, accountant, engineer, or teacher whose performance of such services is solely incidental to the practice of the profession, a broker or dealer whose performance of such services is solely incidental to the conduct of its business and who receives no special compensation, or a family office as defined by Commission rule.

The Commission may bring an action in the proper district court of the United States to enjoin any act or practice constituting a violation of the Advisers Act or of any rule, regulation, or order under it.

The rule takes effect on December 28, 2026, except for three amendatory instructions that take effect on January 1, 2027. The amendments to the decision support interventions criterion in 45 CFR 170.315(b)(11) are made by amendatory instruction 11, which is not one of the three that take effect on January 1, 2027. As amended, the criterion requires technology to enable a limited set of identified users to select, that is, to activate, electronic decision support interventions.

The interventions it reaches include evidence-based decision support interventions that use listed data such as problems, medications, and allergies and intolerances. It also reaches predictive decision support interventions that use that listed data as well as Clinical Notes and Assessment and Plan of Treatment data. Before the amendment, the criterion reached predictive decision support interventions that use any data expressed in the standards in 45 CFR 170.213.

The criterion requires technology to enable a limited set of identified users to configure interventions based on a user's role. It requires technology to enable a user to provide electronic feedback data for evidence-based decision support interventions and to make that feedback data available to a limited set of identified users for export in a computable format. Interventions provided to a user must occur when a user is interacting with technology.

A health IT developer with a Health IT Module certified to a revised certification criterion must update the module and provide the update to its customers in accordance with the dates identified for each revised criterion. The criterion is one of the criteria of a program for the voluntary certification of health IT. The rule removes the source attribute support, source attribute access and modification, and intervention risk management requirements in paragraphs (b)(11)(iv), (v) and (vi).

The preamble states that the removal covers the requirements related to model cards. It removes paragraph (b)(11)(ii)(B) and redesignates the electronic feedback paragraph (b)(11)(ii)(C) as paragraph (b)(11)(ii)(B). It removes the reference to drug-drug and drug-allergy contraindication checking from the selection paragraph.

The Consumer Financial Protection Bureau's final rule published on April 22, 2026 amended Regulation B on disparate impact, discouragement of applicants or prospective applicants, and special purpose credit programs. The rule is effective July 21, 2026.

Section 1002.6(a) now provides that a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis, and that the Act does not provide that the effects test applies for determining whether there is discrimination in violation of the Act.

The official interpretation of section 1002.6(a) says that the Act does not provide for the prohibition of practices that are facially neutral as to prohibited bases, except to the extent that facially neutral criteria function as proxies for protected characteristics designed or applied with the intention of advantaging or disadvantaging individuals based on protected characteristics.

Section 1002.4(b) bars a creditor from making any oral or written statement, in advertising or otherwise, directed at applicants or prospective applicants that the creditor knows or should know would cause a reasonable person to believe that the creditor would deny, or would grant on less favorable terms, a credit application because of a prohibited basis characteristic, and counts spoken or written words and visual images such as symbols, photographs, or videos as statements.

The official interpretation of section 1002.4(b) says that encouraging statements directed at one group of consumers cannot discourage other consumers who were not the intended recipients of the statements. Section 1002.8(b)(3) provides that a special purpose credit program described in paragraph (a)(3) shall not use the race, color, national origin, or sex, or any combination thereof, of the applicant as a common characteristic or factor in determining eligibility for the program.

Section 1002.8(b)(4) allows such a program to require participants to share a characteristic that would otherwise be a prohibited basis only if the for-profit organization provides evidence for each participant who receives credit through the program that in the absence of the program the participant would not receive such credit as a result of those specific characteristics.

Regulation Best Interest requires a broker, dealer, or natural person who is an associated person of a broker or dealer, when making a recommendation of any securities transaction or investment strategy involving securities (including account recommendations) to a retail customer, to act in the best interest of the retail customer at the time the recommendation is made, without placing the financial or other interest of the broker, dealer, or associated person ahead of the interest of the retail customer.

A retail customer is a natural person, or the legal representative of a natural person, who receives a recommendation of any securities transaction or investment strategy involving securities from a broker, dealer, or associated person and uses the recommendation primarily for personal, family, or household purposes.

The disclosure obligation requires the broker, dealer or associated person, prior to or at the time of the recommendation, to provide the retail customer in writing full and fair disclosure of all material facts relating to the scope and terms of the relationship and of all material facts relating to conflicts of interest associated with the recommendation.

The care obligation requires the exercise of reasonable diligence, care, and skill to understand the potential risks, rewards, and costs of the recommendation, to have a reasonable basis to believe that it is in the best interest of the particular retail customer based on that customer's investment profile, and to have a reasonable basis to believe that a series of recommended transactions is not excessive.

The conflict of interest obligation requires a broker or dealer to establish, maintain, and enforce written policies and procedures reasonably designed to identify and disclose or eliminate conflicts of interest associated with recommendations, to mitigate those that create an incentive for an associated person to place the interest of the broker, dealer, or associated person ahead of the interest of the retail customer, and to eliminate sales contests, sales quotas, bonuses, and non-cash compensation based on sales of specific securities within a limited period of time.

The compliance obligation requires a broker or dealer to establish, maintain, and enforce written policies and procedures reasonably designed to achieve compliance with Regulation Best Interest. Regulation Best Interest is effective September 10, 2019. The Commission provided a compliance date of June 30, 2020. The Commission may bring an action in the proper district court of the United States to enjoin acts or practices that violate the Exchange Act or any rule or regulation under it.

Section 39 of the Federal Deposit Insurance Act requires each appropriate Federal banking agency to prescribe standards for all insured depository institutions relating to internal controls, information systems and internal audit systems. The agencies adopted the Interagency Guidelines Establishing Standards for Safety and Soundness in conjunction with a final rule published in the Federal Register in July 1995. That final rule took effect August 9, 1995.

The Guidelines say an institution should have internal controls and information systems that are appropriate to the size of the institution and the nature, scope and risk of its activities. Those controls and systems should provide for effective risk assessment, timely and accurate reports, adequate procedures to safeguard and manage assets, and compliance with applicable laws and regulations.

The Guidelines also say an institution should have an internal audit system, appropriate to its size and the nature and scope of its activities, that provides for adequate monitoring of the system of internal controls through an internal audit function. If an agency determines that an institution fails to meet a standard established by guideline, the agency may require the institution to submit an acceptable plan to achieve compliance with the standard.

If the institution fails to submit an acceptable plan in time, or fails in any material respect to implement an accepted plan, the agency must by order require the institution to correct the deficiency. Until the deficiency is corrected, the agency may also restrict the growth of the institution's assets or require it to increase its ratio of tangible equity to assets.

Neither section 39 nor the Guidelines limits the authority of the agencies to address unsafe or unsound practices or violations of law.

A covered entity must not discriminate on the basis of race, color, national origin, sex, age, or disability in its health programs or activities through the use of patient care decision support tools. A covered entity has an ongoing duty to make reasonable efforts to identify uses of patient care decision support tools in its health programs or activities that employ input variables or factors that measure race, color, national origin, sex, age, or disability.

For each tool identified, a covered entity must make reasonable efforts to mitigate the risk of discrimination resulting from the tool's use in its health programs or activities. A patient care decision support tool is any automated or non-automated tool, mechanism, method, technology, or combination thereof used by a covered entity to support clinical decision-making in its health programs or activities.

A covered entity is a recipient of Federal financial assistance, the Department of Health and Human Services, or an entity established under title I of the Affordable Care Act. The regulations in the part are effective beginning July 5, 2024. The identification and mitigation duties apply within 300 days of July 5, 2024.

The section applies to covered entity users of patient care decision support tools, while the separate requirements of the Office of the National Coordinator for Health Information Technology rule apply to health information technology developers.

Section 703 of Title VII makes it an unlawful employment practice for an employer to fail or refuse to hire, or otherwise to discriminate against, an individual because of race, color, religion, sex, or national origin. Section 703 also bars an employer from limiting, segregating, or classifying applicants for employment in a way that would deprive or tend to deprive an individual of employment opportunities because of those characteristics.

Section 703 separately bars an employment agency from failing or refusing to refer, or from classifying or referring, an individual on those bases.

Under Title VII a disparate impact claim is established when a respondent uses a particular employment practice that causes a disparate impact on those bases and fails to demonstrate that the practice is job related for the position in question and consistent with business necessity, or when the complaining party demonstrates an alternative employment practice and the respondent refuses to adopt it.

Title VII defines an employer as a person engaged in an industry affecting commerce, and any agent of such a person, and excludes the United States, an Indian tribe, and a bona fide private membership club; whether an employer is covered turns on the employee-count test in section 701(b), recorded in the applicability criteria.

Title VII defines an employment agency as any person regularly undertaking to procure employees for an employer or to procure for employees opportunities to work for an employer, and includes an agent of such a person. Section 4 of the Age Discrimination in Employment Act makes it unlawful for an employer to fail or refuse to hire, or otherwise to discriminate against, an individual because of the individual's age.

The Age Discrimination in Employment Act also makes it unlawful for an employment agency to fail or refuse to refer, or to classify or refer, an individual on the basis of age. The Age Discrimination in Employment Act allows an action otherwise prohibited where the differentiation is based on reasonable factors other than age.

The Age Discrimination in Employment Act defines an employer as a person engaged in an industry affecting commerce, includes an agent of such a person and a State or political subdivision of a State, and excludes the United States; whether an employer is covered turns on the employee-count test in section 11(b), recorded in the applicability criteria.

For the subpart that holds the rule, a telecommunications carrier includes an entity that provides interconnected VoIP service. A telecommunications carrier must electronically notify the United States Secret Service and the Federal Bureau of Investigation through a central reporting facility as soon as practicable, and in no event later than seven business days, after reasonable determination of a breach of its customers' CPNI.

The carrier may not notify its customers or disclose the breach to the public until 7 full business days have passed after notification to the Secret Service and the FBI, except as the rule provides in its paragraphs (b)(2) and (b)(3). A carrier that believes there is an extraordinarily urgent need to notify a class of affected customers sooner, in order to avoid immediate and irreparable harm, may proceed to notify them immediately only after consultation with the relevant investigating agency.

An investigating agency that determines that public disclosure or notice to customers would impede an ongoing or potential criminal investigation or national security may direct the carrier not to disclose or notify for an initial period of up to 30 days. After it has completed notifying law enforcement, the carrier must notify its customers of a breach of those customers' CPNI.

Every carrier must maintain a record of breaches discovered, notifications to the Secret Service and the FBI, and notifications to customers, and must retain the record for a minimum of 2 years. A breach has occurred when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI.

The Commission's 2023 data breach order rewrote the section, but the amendments to section 64.2011 are delayed indefinitely until the Commission announces their effective dates in the Federal Register.

The Health Breach Notification Rule applies to foreign and domestic vendors of personal health records, PHR related entities and third party service providers that maintain information of United States citizens or residents, and it does not apply to Health Insurance Portability and Accountability Act (HIPAA)-covered entities or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity.

A vendor of personal health records and a PHR related entity must notify each affected individual and the Federal Trade Commission after discovering a breach of security of unsecured PHR identifiable health information, and must also notify prominent media outlets serving a State or jurisdiction when the information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.

A third party service provider that discovers a breach of security must notify an official designated in a written contract by the vendor of personal health records or PHR related entity it serves, or a senior official of that vendor or entity if none is designated, and must obtain acknowledgment that the official received the notice.

Except where a law enforcement official's determination delays a notice, notices to individuals and the media, and the notice a third party service provider gives the vendor or entity it serves, must be sent without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach of security. The amendments to the rule are effective July 29, 2024.

The rule defines health care services or supplies to include any online service such as a website, mobile application or internet-connected device that provides mechanisms to track diseases, health conditions, fitness, sleep, diet or other listed health matters, or that provides other health-related services or tools.

A person that violates a rule under the Federal Trade Commission Act respecting unfair or deceptive acts or practices with actual knowledge, or knowledge fairly implied on the basis of objective circumstances, that the act is unfair or deceptive and prohibited by the rule is liable for a civil penalty, written in the statute as not more than $10,000 for each violation.

The Commission's maximum civil penalty under section 5(m)(1)(A) of the Federal Trade Commission Act is $53,088 for penalties assessed after January 17, 2025. The Commission's civil penalty amounts remain unchanged during 2026.

Written notice to an individual may be sent by electronic mail if the individual has specified electronic mail as the primary method of communication, and otherwise a vendor of personal health records or PHR related entity may provide notice by first-class mail at the last known address of the individual. Each day of continuance of a violation through continuing failure to comply with a rule is treated as a separate violation.

A breach of security is treated as discovered on the first day on which it is known or reasonably should have been known to the vendor, PHR related entity or third party service provider, and the knowledge of an employee, officer or other agent counts.

Requires a financial institution covered by the FTC's Safeguards Rule to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. The notification requirement in Section 314.4(j) took effect on May 13, 2024, per 16 CFR 314.5's own effective-date provision.

Requires a covered entity to notify each affected individual, and in some cases HHS and the media, following discovery of a breach of unsecured protected health information, without unreasonable delay and no later than 60 calendar days after discovery. First effective under a 2009 interim final rule; the 2013 Health Insurance Portability and Accountability Act (HIPAA) Omnibus Rule finalized these requirements with a general compliance date of September 23, 2013.

A covered institution is any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. A covered institution must maintain a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

Unless it determines after a reasonable investigation that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, a covered institution must give a clear and conspicuous notice to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, by a means designed to ensure that each can reasonably be expected to receive actual notice in writing.

A covered institution must provide the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The notice must describe in general terms the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization, and must include the other items the paragraph lists.

The obligation to ensure that affected individuals are notified rests with the covered institution even where it uses a service provider. The covered institution's policies and procedures must be reasonably designed to ensure that a service provider notifies the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.

Sensitive customer information means any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. The amendments took effect on August 2, 2024. The Commission provided an 18-month compliance period after the date of publication in the Federal Register for larger entities.

Prohibits U.S. persons from engaging in data-brokerage transactions involving bulk U.S. sensitive personal data or government-related data with a country of concern or covered person, and restricts, subject to required security measures, vendor, employment, and investment-agreement transactions that would give such a country or person access to bulk sensitive personal data, including biometric identifiers such as facial images or voice prints collected on more than 1,000 U.S. persons, or human genomic data on more than 100.

Data counts as bulk U.S. sensitive personal data regardless of whether it is anonymized, pseudonymized, de-identified, or encrypted, once it meets or exceeds the applicable threshold.

Makes it unlawful for a data broker to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to any foreign adversary country or to any entity that is controlled by a foreign adversary.

A violation is treated as a violation of a rule defining an unfair or a deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act, and the Federal Trade Commission enforces the section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as that Act. The section takes effect on the date that is 60 days after April 24, 2024.

A data broker is an entity that, for valuable consideration, sells, licenses, rents, trades, transfers, releases, discloses, provides access to, or otherwise makes available data of United States individuals that the entity did not collect directly from such individuals to another entity that is not acting as a service provider.

The term does not include an entity to the extent it transmits data of a United States individual at the request or direction of that individual, provides a product or service with respect to which personally identifiable sensitive data, or access to such data, is not the product or service, reports or publishes news or information that concerns events or other matters of public interest, makes available news or information that is available to the general public other than an obscene visual depiction, or acts as a service provider.

A service provider collects, processes, or transfers data on behalf of, and at the direction of, an individual or entity that is not a foreign adversary country or controlled by a foreign adversary, or a Federal, State, Tribal, territorial, or local government entity, and receives data from or on behalf of such a person.

An individual or entity is controlled by a foreign adversary if it is a foreign person that is domiciled in, is headquartered in, has its principal place of business in, or is organized under the laws of a foreign adversary country, if such foreign persons directly or indirectly own at least a 20 percent stake in it, or if it is subject to the direction or control of such a foreign person or entity.

The Act defines a foreign adversary country as a country specified in section 4872(d)(2) of title 10, United States Code. Section 4872 of title 10 names the Democratic People's Republic of North Korea, the People's Republic of China, the Russian Federation and the Islamic Republic of Iran as covered nations.

Personally identifiable sensitive data is sensitive data that identifies or is linked or reasonably linkable, alone or in combination with other data, to an individual or to a device that identifies or is linked or reasonably linkable to an individual.

Sensitive data includes a government-issued identifier such as a Social Security number, passport number, or driver's license number, information that describes or reveals the past, present, or future physical health, mental health, disability, diagnosis, or healthcare condition or treatment of an individual, a financial account number, debit card number, or credit card number or information that describes or reveals the income level or bank account balances of an individual, biometric information, genetic information, precise geolocation information, an individual's private communications such as voicemails, emails, texts, direct messages, mail, voice communications, and video communications, or information identifying the parties to such communications or pertaining to their transmission, account or device log-in credentials or security or access codes, information identifying the sexual behavior of an individual, calendar information, address book information, phone or text logs, photos, audio recordings, or videos maintained for private use by an individual regardless of whether stored on the individual's device or accessible from it, a photograph, film, video recording, or similar medium that shows the naked or undergarment-clad private area of an individual, information revealing the video content requested or selected by an individual, information about an individual under the age of 17, an individual's race, color, ethnicity, or religion, information identifying an individual's online activities over time and across websites or online services, information that reveals the status of an individual as a member of the Armed Forces, and any other data that a data broker makes available to a foreign adversary country or an entity controlled by a foreign adversary for the purpose of identifying those types of data.

Precise geolocation information is information derived from a device or technology of an individual that reveals the past or present physical location of an individual or of a device that identifies or is linked or reasonably linkable to one or more individuals, with sufficient precision to identify street level location information or the location of an individual or device within a range of 1,850 feet or less. A United States individual is a natural person residing in the United States.

Requires operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from such children, to give notice and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, and to give parents a means to review and delete it.

The FTC's 2025 amendments, effective June 23, 2025, add biometric identifiers, including voiceprints and facial templates, to the covered definition of personal information.

A financial institution may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless it has given the consumer the initial notice and an opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.

The limit applies whether or not the institution has established a customer relationship with the consumer, and it reaches all nonpublic personal information the institution has collected, whether before or after it receives the direction to opt out.

An opt out notice must be clear and conspicuous and must state that the institution discloses or reserves the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the right.

Allowing the consumer to opt out by mailing a form, calling a toll-free telephone number, or any other reasonable means within 30 days from the date the notices were mailed is an example of a reasonable opportunity to opt out.

The opt out requirements do not apply when the institution provides nonpublic personal information to a nonaffiliated third party to perform services for it or functions on its behalf, if it provides the initial notice and enters into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which it was disclosed.

A financial institution must not, directly or through an affiliate, disclose an account number or similar access number or access code for a consumer's credit card account, deposit account, share account or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency or to an agent or service provider that performs marketing solely for the institution's own products or services and is not authorized to directly initiate charges to the account.

A recipient of nonpublic personal information from a nonaffiliated financial institution under a processing or other exception may disclose it to the affiliates of that institution, to its own affiliates, and under an exception to carry out the activity covered by the exception under which it received the information.

Part 1016 applies to the financial institutions and other persons for which the Bureau of Consumer Financial Protection has rulemaking authority under section 504(a)(1)(A) of the Gramm-Leach-Bliley Act, including third parties that are not financial institutions but that receive nonpublic personal information from financial institutions with whom they are not affiliated.

Part 1016 does not apply to certain motor vehicle dealers, a person subject to the jurisdiction of the Commodity Futures Trading Commission under section 7b-2 of title 7, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

A financial institution must comply with a consumer's opt out direction as soon as reasonably practicable after it receives it, the consumer may opt out at any time, and the direction is effective until the consumer revokes it in writing or, if the consumer agrees, electronically.

The opt out requirements do not apply if the institution discloses nonpublic personal information as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes, or in connection with servicing or processing a requested product or service, maintaining or servicing the consumer's account, or a proposed or actual securitization or secondary market sale.

The opt out requirements do not apply to a disclosure made with the consent or at the direction of the consumer, provided the consumer has not revoked the consent or direction.

A recipient, including one that is not a financial institution, that receives nonpublic personal information from a nonaffiliated financial institution outside an exception may disclose it only to the affiliates of that institution, to its own affiliates, and to any other person if the disclosure would be lawful if made directly to that person by the institution that provided it.

Prohibits unfair or deceptive acts or practices in or affecting commerce and empowers the FTC, not private plaintiffs, to investigate and enforce against them. This is the primary federal vehicle for privacy and data-security enforcement in the absence of a comprehensive statute, reaching misrepresentations about data collection or protection and unfair data practices that cause substantial, unavoidable consumer injury.

The Commission's 2023 Policy Statement on Biometric Information applies this authority to biometric identifiers, including those derived from photographs, videos, or voice recordings.

Regulation P requires a financial institution to give each customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when it establishes the customer relationship. A financial institution must give a consumer who is not a customer that notice before it discloses any nonpublic personal information about the consumer to any nonaffiliated third party, other than as sections 1016.14 and 1016.15 authorize.

Except as the annual notice exception provides, a financial institution must give each customer the notice not less than annually during the continuation of the customer relationship, which means at least once in any period of 12 consecutive months.

A financial institution is not required to deliver an annual notice if it provides nonpublic personal information to nonaffiliated third parties only as sections 1016.13, 1016.14 or 1016.15 allow and has not changed its disclosure policies and practices from those in its most recent notice.

Each notice must state the categories of nonpublic personal information the institution collects and discloses, the categories of affiliates and nonaffiliated third parties to which it discloses it, the consumer's right to opt out and how to exercise it, and the institution's policies and practices for protecting the confidentiality and security of the information.

Part 1016 applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes, and not to information about companies or about individuals who obtain them for business, commercial, or agricultural purposes.

Part 1016 applies to the financial institutions and other persons for which the Bureau of Consumer Financial Protection has rulemaking authority under section 504(a)(1)(A) of the Gramm-Leach-Bliley Act.

Part 1016 does not apply to certain motor vehicle dealers, a person subject to the jurisdiction of the Commodity Futures Trading Commission under section 7b-2 of title 7, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

The Federal Trade Commission's own privacy rule, 16 CFR Part 313, applies to the financial institutions over which the Commission has rulemaking authority, which are the persons described in section 5519 of title 12 that are predominantly engaged in the sale and servicing or the leasing and servicing of motor vehicles.

The Gramm-Leach-Bliley Act's privacy subchapter and the regulations under it are enforced by the Bureau of Consumer Financial Protection, the Federal functional regulators, the State insurance authorities and the Federal Trade Commission, each with respect to the financial institutions and other persons subject to its jurisdiction under applicable law.

A financial institution may not, except as otherwise authorized in Part 1016, disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in its initial notice unless it has given a clear and conspicuous revised notice that accurately describes its policies and practices and a new opt out notice, has given a reasonable opportunity to opt out, and the consumer does not opt out.

A financial institution that loses the annual notice exception must give an annual notice within 100 days of the change in its policies or practices, or on the annual schedule treating a required revised notice as an initial notice.

Section 3022 of the Public Health Service Act defines information blocking as a practice that, except as required by law or specified by the Secretary in rulemaking, is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.

A health information technology developer, exchange or network engages in it if it knows, or should know, that the practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information, and a health care provider engages in it only if the provider knows that the practice is unreasonable and is likely to do so.

The regulations in 45 CFR Part 171 apply to health care providers, health IT developers of certified health IT, health information exchanges, and health information networks, which are subject to the part on and after April 5, 2021.

A health IT developer of certified health IT is an individual or entity, other than a health care provider that self-develops health IT that is not offered to others, that develops or offers health information technology and has, at the time of the practice, one or more Health IT Modules certified under the voluntary certification program the National Coordinator keeps or recognizes.

A health information network or health information exchange is an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of any technology or services for access, exchange, or use of electronic health information among more than two unaffiliated individuals or entities that are enabled to exchange with each other, for a treatment, payment, or health care operations purpose.

Electronic health information means electronic protected health information to the extent that it would be included in a designated record set, regardless of whether the group of records are used or maintained by or for a covered entity, and excludes psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

A practice is not treated as information blocking if the actor satisfies an exception in Subpart B by meeting all applicable requirements and conditions of the exception at all relevant times. The Subpart B exceptions are the preventing harm, privacy, security, infeasibility and health IT performance exceptions and the exception for protecting care access. The Subpart C exceptions are the manner, fees and licensing exceptions.

Subpart D adds an exception for limiting the manner in which an actor fulfills a request to only via the Trusted Exchange Framework and Common Agreement. A developer of certified health information technology, an entity offering it, or a health information exchange or network that the Inspector General determines, after an investigation, to have committed information blocking is subject to a civil monetary penalty determined by the Secretary, which may not exceed $1,000,000 per violation.

A health care provider that the Inspector General determines to have committed information blocking is referred to the appropriate agency to be subject to appropriate disincentives.

The rule applies to a financial institution or creditor subject to administrative enforcement of the Fair Credit Reporting Act by the Commodity Futures Trading Commission. A financial institution includes any futures commission merchant, retail foreign exchange dealer, commodity trading advisor, commodity pool operator, introducing broker, swap dealer, or major swap participant that directly or indirectly holds a transaction account belonging to a consumer.

Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts, and must conduct a risk assessment that considers the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft.

Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.

The Identity Theft Prevention Program must include reasonable policies and procedures to identify relevant Red Flags and incorporate them into the Identity Theft Prevention Program, detect them, respond appropriately to them to prevent and mitigate identity theft, and update the Identity Theft Prevention Program periodically.

The institution must obtain approval of the initial written Identity Theft Prevention Program from its board of directors or an appropriate committee of the board, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements. The rules were effective May 20, 2013, with a compliance date of November 20, 2013.

42 CFR Part 2 restricts the use and disclosure of records that would identify a patient as having or having had a substance use disorder and that contain substance use disorder information obtained by a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment or referral for treatment.

A lawful holder, meaning a person who received the records under a written consent with an accompanying notice of disclosure or under one of the exceptions to the consent requirements, is bound by the Part as well. The records may be used or disclosed only as the Part permits, limited to the information necessary for the purpose, and may not otherwise be used or disclosed in any civil, criminal, administrative or legislative proceeding by a Federal, state or local authority.

A written consent must include the patient's name, the person or class of persons authorized to make the disclosure, the recipient or class of recipients, a description of the information and a description of each purpose. Each disclosure made with the patient's written consent must be accompanied by one of two written statements of the Federal confidentiality rules.

A general authorization for the release of medical or other information is not sufficient to permit further use or redisclosure of the record. A part 2 program or other lawful holder must have formal policies and procedures to protect patient identifying information, and the Health Insurance Portability and Accountability Act (HIPAA) breach provisions apply to a part 2 program for breaches of unsecured records in the same manner as they apply to a covered entity.

A person who violates the statute is subject to the applicable penalties under sections 1176 and 1177 of the Social Security Act.

A State department of motor vehicles, and any officer, employee or contractor of it, may not knowingly disclose or otherwise make available to any person or entity personal information about an individual obtained by the department in connection with a motor vehicle record, except as section 2721(b) provides.

A State department of motor vehicles may not disclose highly restricted personal information about an individual without the individual's express consent, except for the uses permitted in section 2721(b)(1), (b)(4), (b)(6) and (b)(9). It is unlawful for any person knowingly to obtain or disclose personal information from a motor vehicle record for any use that section 2721(b) does not permit.

An authorized recipient of personal information, other than one under section 2721(b)(11) or (12), may resell or redisclose the information only for a use permitted under section 2721(b). An authorized recipient other than one under section 2721(b)(11) that resells or rediscloses personal information must keep for 5 years records identifying each person or entity that receives it and the permitted purpose, and must make the records available to the motor vehicle department upon request.

A person who knowingly obtains, discloses or uses personal information from a motor vehicle record for a purpose the chapter does not permit is liable to the individual to whom it pertains, who may bring a civil action in a United States district court.

The court may award actual damages but not less than liquidated damages of $2,500, punitive damages on proof of willful or reckless disregard of the law, reasonable attorneys' fees and other litigation costs, and other preliminary and equitable relief. A State department of motor vehicles with a policy or practice of substantial noncompliance with the chapter is subject to a civil penalty imposed by the Attorney General of not more than $5,000 for each day of substantial noncompliance.

A motor vehicle record is any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration or identification card issued by a department of motor vehicles. Personal information does not include information on vehicular accidents, driving violations, and driver's status. Research use and the production of statistical reports are permitted so long as the personal information is not published, redisclosed, or used to contact individuals.

Use for bulk distribution for surveys, marketing or solicitations is permitted if the State has obtained the express consent of the person to whom the personal information pertains. Use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting is a permitted use.

Public Law 106-69 of 1999 substituted the State's express consent for the earlier opportunity-to-prohibit procedures in section 2721(b)(11) and (b)(12). The 1999 amendments of section 2721(b)(11) and (b)(12) took effect June 1, 2000, with later dates in nine named States. Public Law 106-346 amended the text of section 2721(a) generally and inserted ", subject to subsection (a)(2)," before "may be disclosed" in the introductory provisions of section 2721(b).

The Fair Credit Reporting Act was enacted on October 26, 1970, and section 504(d) of the Consumer Credit Protection Act provides that it takes effect upon the expiration of 180 days following its enactment.

It governs a consumer report, which is any communication by a consumer reporting agency of information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes, for employment purposes, or for another purpose section 1681b authorizes.

A consumer reporting agency is any person that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and that uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

A consumer reporting agency may furnish a consumer report only under the circumstances section 1681b(a) lists, among them a court order, the consumer's written instructions, and a recipient it has reason to believe intends to use the report in connection with a credit transaction, for employment purposes, or in connection with the underwriting of insurance.

A person shall not use or obtain a consumer report for any purpose unless the report is obtained for a purpose for which it is authorized to be furnished and the purpose is certified by a prospective user of the report.

Except for a transportation applicant who applies by mail, telephone, computer, or other similar means and instead receives notice orally, in writing, or electronically, a person may not procure a consumer report for employment purposes unless a clear and conspicuous disclosure has been made in writing to the consumer, in a document that consists solely of the disclosure, and the consumer has authorized the procurement in writing.

Before taking adverse action based in whole or in part on a consumer report used for employment purposes, the person must give the consumer a copy of the report and a written description of the consumer's rights, except for a transportation applicant who applies by mail, telephone, computer, or other similar means and receives a notice within 3 business days of the action.

Whenever a consumer reporting agency prepares a consumer report it must follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates. A consumer reporting agency must, upon request and subject to section 1681h(a)(1), clearly and accurately disclose to the consumer all information in the consumer's file at the time of the request, other than credit scores and other risk scores.

If a consumer disputes the completeness or accuracy of an item in the consumer's file, the agency must, free of charge, conduct a reasonable reinvestigation before the end of the 30-day period beginning on the date it receives the notice of the dispute, a period that may be extended by not more than 15 additional days if the agency receives relevant information from the consumer during that period.

A person who takes adverse action against a consumer based in whole or in part on information in a consumer report must give the consumer notice of the action, disclosure of a numerical credit score the person used in taking the action, the name, address, and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.

A person shall not furnish information relating to a consumer to a consumer reporting agency if the person knows or has reasonable cause to believe that the information is inaccurate. After receiving notice of a dispute from a consumer reporting agency, a person who furnished the information must investigate, report the results to the agency, and modify, delete, or permanently block an item found inaccurate, incomplete, or unverifiable.

A person who willfully fails to comply with a requirement of the Act is liable to the consumer for actual damages or damages of not less than $100 and not more than $1,000, punitive damages the court allows, and the costs of the action and reasonable attorney's fees. A person who is negligent in failing to comply is liable to the consumer for actual damages and the costs of the action and reasonable attorney's fees.

Except as provided in section 1681s(c)(1)(B), sections 1681n and 1681o do not apply to a violation of section 1681s-2(a), which is enforced exclusively by the Federal agencies and officials and the State officials identified in section 1681s. The Federal Trade Commission is authorized to enforce compliance with the Act under the Federal Trade Commission Act, except to the extent that enforcement is specifically committed to some other Government agency.

If the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that a person has violated the Act, the State may bring an action to enjoin the violation and, subject to section 1681s(c)(5), an action on behalf of the residents of the State to recover damages, and it is awarded the costs of a successful action and reasonable attorney fees.

A person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under title 18, imprisoned for not more than 2 years, or both. An officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency's files to a person not authorized to receive that information shall be fined under title 18, imprisoned for not more than 2 years, or both.

A State may not impose a requirement or prohibition with respect to any subject matter regulated under section 1681c, relating to information contained in consumer reports, or under section 1681s-2, relating to the responsibilities of persons who furnish information to consumer reporting agencies, except that the bar does not apply to any State law in effect on September 30, 1996 for the first, or to section 54A(a) of chapter 93 of the Massachusetts Annotated Laws and section 1785.25(a) of the California Civil Code, each as in effect on September 30, 1996, for the second.

The provisions this entry describes came into force on different days.

The Family Educational Rights and Privacy Act withholds federal education funds from an educational agency or institution that has a policy or practice of releasing students' education records, or the personally identifiable information in them, without the written consent of their parents, except to the parties the Act lists.

The regulations in 34 CFR Part 99 apply to an educational agency or institution to which funds have been made available under any program administered by the Secretary of Education.

A contractor, consultant, volunteer or other party to whom the school has outsourced institutional services or functions may be considered a school official, and so receive personally identifiable information from education records without consent, if it performs an institutional service or function for which the school would otherwise use employees, is under the school's direct control with respect to the use and maintenance of education records, and is subject to the use and redisclosure requirements of section 99.33(a).

Under section 99.33(a), the school may disclose the information only on the condition that the recipient will not disclose it to any other party without the prior consent of the parent or eligible student, and the recipient's officers, employees and agents may use it only for the purposes for which the disclosure was made.

If the Department's enforcement Office finds that a third party outside the school improperly rediscloses personally identifiable information from education records in violation of section 99.33, or fails to give a notification section 99.33(b)(2) requires, the school from which the information originated may not allow that party access to personally identifiable information from education records for at least five years.

The Secretary of Education enforces the Act, and may terminate assistance only on finding a failure to comply that cannot be secured by voluntary means. The Supreme Court's 2002 decision in Gonzaga University held that the relevant provisions of the Act create no personal rights enforceable under section 1983 of title 42.

Restricts covered entities (health plans, health care clearinghouses, and most health care providers) and their business associates from using or disclosing protected health information except as the Rule permits or requires, and conditions most non-routine disclosures on individual authorization.

Its de-identification safe harbor is the one place federal law names biometric identifiers, including voice prints and full-face photographic images, as identifiers that must be stripped before health data is treated as de-identified.

One method of de-identification is an expert determination: a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results of the analysis.

The other method is the safe harbor: the identifiers the Rule lists, which include names, biometric identifiers and full face photographic images, are removed for the individual and for relatives, employers and household members, and the covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual.

A covered entity may assign a code to allow de-identified information to be re-identified only if the code is not derived from or related to information about the individual and cannot be translated to identify the individual, and the entity does not use or disclose the code for any other purpose or disclose the mechanism for re-identification.

The Homebuyers Privacy Protection Act, Public Law 119-36, amends section 604(c) of the Fair Credit Reporting Act by adding a paragraph (4) on the treatment of prescreening report requests.

If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, the agency may not, based in whole or in part on that request, furnish a consumer report to another person under that subsection unless the transaction consists of a firm offer of credit or insurance and the other person has submitted documentation certifying that it has the consumer's authorization.

The other person may instead be one that has originated a current residential mortgage loan of the consumer, is the servicer of one, or is an insured depository institution or credit union that holds a current account for the consumer. The Act also directs the Comptroller General to study the value of trigger leads received by text message and to report to Congress within 12 months of enactment.

The rule applies to a financial institution or creditor that is a broker, dealer or other person registered or required to be registered under the Securities Exchange Act of 1934, an investment company registered or required to be registered under the Investment Company Act of 1940, or an investment adviser registered or required to be registered under the Investment Advisers Act of 1940.

Each financial institution or creditor must periodically determine whether it offers or maintains covered accounts, and must conduct a risk assessment that considers the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft.

Each financial institution or creditor that offers or maintains one or more covered accounts must develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.

The Program must include reasonable policies and procedures to identify relevant Red Flags and incorporate them into the Program, detect them, respond appropriately to them to prevent and mitigate identity theft, and update the Program periodically.

The institution must obtain approval of the initial written Program from its board of directors or an appropriate committee of the board, involve the board, a committee or a designated senior-management employee in its oversight, train staff as necessary, and exercise appropriate and effective oversight of service provider arrangements. The rules were effective May 20, 2013, with a compliance date of November 20, 2013.

Section 2705(b) lets a governmental entity apply to a court for an order commanding a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or court order is directed, for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order.

The governmental entity may apply when it is acting under section 2703 and is not required to notify the subscriber or customer under section 2703(b)(1), or to the extent that it may delay that notice under subsection (a) of section 2705.

The court shall enter the order if it determines that there is reason to believe that notification of the existence of the warrant, subpoena, or court order will result in endangering the life or physical safety of an individual, flight from prosecution, destruction of or tampering with evidence, intimidation of potential witnesses, or otherwise seriously jeopardizing an investigation or unduly delaying a trial.

Section 2705 took effect ninety days after the enactment of Public Law 99-508 on October 21, 1986, and, for conduct under a court order or extension, applies only to orders and extensions made after that effective date.

Chapter 121 of title 18 is popularly known as the Stored Communications Act. Chapter 121 was added by Public Law 99-508, enacted on October 21, 1986, and Title II of that law took effect ninety days after the date of its enactment. A person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.

A person or entity providing remote computing service to the public shall not knowingly divulge the contents of a communication that it carries or maintains for a subscriber or customer solely for the purpose of providing storage or computer processing services, if the provider is not authorized to access the contents for any other service.

A provider of remote computing service or electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a subscriber or customer, not including the contents of communications, to any governmental entity.

A provider may divulge the contents of a communication to an addressee or intended recipient, with the lawful consent of the originator or an addressee or intended recipient, or of the subscriber in the case of remote computing service, or as may be necessarily incident to the rendition of the service or to the protection of the rights or property of the provider, among the other exceptions in section 2702(b).

A provider may divulge a record or other information pertaining to a subscriber or customer, not including the contents of communications, to any person other than a governmental entity. A governmental entity may require a provider of electronic communication service to disclose the contents of a communication that has been in electronic storage for one hundred and eighty days or less only pursuant to a warrant.

A governmental entity may require a provider of remote computing service to disclose contents without notice to the subscriber if it obtains a warrant, or with prior notice to the subscriber if it uses an administrative subpoena, a grand jury or trial subpoena, or a court order under subsection (d) of section 2703.

A governmental entity may require a provider to disclose a record or other information pertaining to a subscriber, not including contents, only when it obtains a warrant, obtains a court order under subsection (d), has the consent of the subscriber or customer, submits a formal written request in a telemarketing fraud investigation, or seeks the subscriber information listed in section 2703(c)(2) with a subpoena.

A court order under subsection (d) of section 2703 shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents or the records sought are relevant and material to an ongoing criminal investigation.

No cause of action shall lie in any court against a provider of wire or electronic communication service for providing information, facilities, or assistance in accordance with the terms of a court order, warrant, subpoena, statutory authorization, or certification under the chapter.

Except as provided in section 2703(e), a provider of electronic communication service, a subscriber, or another person aggrieved by a violation of the chapter committed with a knowing or intentional state of mind may bring a civil action against the person or entity, other than the United States, that engaged in the violation.

The court may assess actual damages and any profits made by the violator, but a person entitled to recover shall receive not less than $1,000, and may assess punitive damages if the violation is willful or intentional. Among the grounds in section 2707(e), a good faith reliance on a court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory authorization is a complete defense to any civil or criminal action brought under the chapter or any other law.

A civil action may not be commenced later than two years after the claimant first discovered or had a reasonable opportunity to discover the violation. The remedies and sanctions described in the chapter are the only judicial remedies and sanctions for nonconstitutional violations of the chapter. The provisions this entry describes came into force on different days.

Section 2713 of title 18 requires a provider of electronic communication service or remote computing service to comply with the obligations of chapter 121 to preserve, back up or disclose the contents of a wire or electronic communication and any customer or subscriber record within the provider's possession, custody or control, whether the data is located inside or outside the United States. Public Law 115-141, division V, added section 2713 on March 23, 2018.

A provider of electronic communication service to the public or remote computing service that must disclose contents under legal process issued under section 2703 may move to modify or quash the process where it reasonably believes that the customer or subscriber is not a United States person and does not reside in the United States and that disclosure would create a material risk of violating the laws of a qualifying foreign government.

The motion must be filed within 14 days after the provider was served, unless the government agrees or the court extends the deadline on an application made within the 14 days. The court may modify or quash the process only if it finds that disclosure would cause the provider to violate the laws of a qualifying foreign government, that the interests of justice dictate it, and that the customer or subscriber is not a United States person and does not reside in the United States.

While the motion is pending the provider must preserve, but need not produce, the information sought, unless the court finds that immediate production is necessary to prevent an adverse result identified in section 2705(a)(2). A qualifying foreign government is one with which the United States has an executive agreement in force under section 2523 and whose laws give providers similar opportunities to challenge the process.

Prohibits a video tape service provider from knowingly disclosing a consumer's personally identifiable information about video-viewing history to a third party without informed, written consent, and arms an aggrieved consumer with a private right of action for statutory damages of at least $2,500, punitive damages, and attorneys' fees.

A 2013 amendment allowed ongoing consent through an electronic means, enabling social-media sharing features; the statute has driven a large wave of litigation since 2022 over website tracking-pixel disclosures of video-viewing activity.

The Computer Fraud and Abuse Act (CFAA) prohibits intentionally accessing a protected computer without authorization, or exceeding authorized access.

The Supreme Court held in Van Buren v. United States (593 U.S. 374, 2021) that exceeding authorized access is a gates-up-or-down inquiry into files or areas an existing permission structure puts off limits, not a purpose-based test, and the Ninth Circuit held in hiQ Labs v. LinkedIn (31 F.4th 1180, 2022) that without authorization does not reach a computer presumptively open to all comers, so a public, unauthenticated page has erected no gate at all.

The line runs through revocation: in Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016), discussed inside the hiQ opinion, liability attached once the scraper, after an individualized cease-and-desist, circumvented an IP block to keep reaching password-protected profiles. hiQ's own case did not end there: on remand it entered a stipulated consent judgment (N.D. Cal., filed Dec.

2022, secondary-sourced) holding it liable for breaching LinkedIn's User Agreement and for California trespass to chattels and misappropriation, for $500,000 and a permanent injunction, despite winning the CFAA claim outright. Section 1030 was added by the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub.

L. 98-473, title II, § 2102(a); the without-authorization and exceeds-authorized-access language the courts above construe was already present in that original 1984 enactment, so the section dates to its original commencement rather than to the 1986 amendments that broadened its reach to protected computers generally.

Section 1201 prohibits circumventing a technological measure that effectively controls access to a copyrighted work. It functions as an escalation point rather than a scraping-specific rule: it is invoked once a target has put up a technical access barrier and a collector defeats it, the same fact pattern that also triggers Computer Fraud and Abuse Act (CFAA) and state computer-misuse exposure once notice and continued access or circumvention are shown, as in Facebook v. Power Ventures.

Section 1201 was added by title I of the Digital Millennium Copyright Act, Pub. L. 105-304, approved October 28, 1998; the anti-circumvention prohibition in subsection (a)(1)(A) itself carried a built-in two-year delayed effective date, so it did not bind conduct until October 28, 2000, the same window in which the Librarian of Congress ran the first rulemaking under subsection (a)(1)(C) to identify exempt classes of works.

The Stored Communications Act makes it a federal offense to intentionally access without authorization a facility through which an electronic communication service is provided, or to intentionally exceed an authorization to access that facility, and thereby obtain, alter or prevent authorized access to a wire or electronic communication while it is in electronic storage in that system.

A first offense committed for commercial advantage, malicious destruction or damage, private commercial gain, or in furtherance of a criminal or tortious act is punished by a fine or imprisonment for not more than 5 years, and any other first offense by a fine or imprisonment for not more than 1 year.

The offense does not apply to conduct authorized by the person or entity providing a wire or electronic communications service, by a user of that service with respect to a communication of or intended for that user, or under section 2703, 2704 or 2518 of Title 18. A provider of electronic communication service, a subscriber or another person aggrieved by a violation committed with a knowing or intentional state of mind may bring a civil action for such relief as may be appropriate.

Damages are the actual damages plus the violator's profits, but never less than $1,000, and the court may assess punitive damages if the violation is willful or intentional. The chapter was added by Public Law 99-508 in 1986 and took effect ninety days after the date of enactment of that Act. The Eleventh Circuit held in Sartori v. Schrodt that the creator and co-owner of an online account is authorized to access it. That court did not reach whether opened emails are kept in electronic storage under the Act.

Section 1202(b) prohibits, without the authority of the copyright owner or the law, intentionally removing or altering any copyright management information. It also prohibits distributing or importing for distribution copyright management information, and distributing, importing for distribution or publicly performing works or copies, knowing that the information has been removed or altered without authority.

The paragraph on distributing works or copies whose information has been removed or altered ends with a requirement that the person know, or for civil remedies have reasonable grounds to know, that the act will induce, enable, facilitate, or conceal an infringement. Section 1202(a) prohibits knowingly providing, or distributing or importing for distribution, false copyright management information with the intent to induce, enable, facilitate, or conceal infringement.

Section 1202(c) defines copyright management information as certain information conveyed in connection with copies or performances of a work, and excludes personally identifying information about a user. The definition includes the title and other information identifying the work, the names of the author and the copyright owner, the information on a notice of copyright, and the terms and conditions for use of the work.

Section 1203 lets any person injured by a violation of section 1202 bring a civil action in federal district court. A complaining party may elect statutory damages of not less than $2,500 or more than $25,000 for each violation of section 1202. Section 1204 punishes a willful violation for purposes of commercial advantage or private financial gain with a fine of not more than $500,000 or imprisonment for not more than 5 years, or both, for a first offense.

The criminal penalty does not apply to a nonprofit library, archives, educational institution, or public broadcasting entity. Section 1202 was added to the Copyright Act on October 28, 1998. The effective date of the chapter that contains it is October 28, 1998.

Section 524B(a) requires a person who submits an application or submission under section 360(k), 360c, 360e(c), 360e(f), or 360j(m) of title 21 for a device that meets the definition of a cyber device to include such information as the Secretary may require to ensure that the cyber device meets the cybersecurity requirements of subsection (b).

Section 524B(c) defines a cyber device as a device that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

Section 524B(b)(1) requires the sponsor to submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures. Section 524B(b)(2) requires the sponsor to design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure.

Section 524B(b)(2)(A) requires the sponsor to make available postmarket updates and patches to the device and related systems to address known unacceptable vulnerabilities on a reasonably justified regular cycle. Section 524B(b)(2)(B) requires the sponsor to make available postmarket updates and patches to address critical vulnerabilities that could cause uncontrolled risks as soon as possible out of cycle.

Section 524B(b)(3) requires the sponsor to provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components. Section 524B(b)(4) requires the sponsor to comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure.

Section 524B(d) lets the Secretary identify devices, or categories or types of devices, that are exempt from the cybersecurity requirements established by the section and regulations promulgated under it. Section 3305(d) of Public Law 117-328 provides that the amendments adding section 524B take effect 90 days after the date of enactment, December 29, 2022.

Section 3305(d) also provides that an application or submission submitted before that effective date is not subject to the requirements of section 524B(a) or (b). The Food and Drug Administration states that section 524B(a) applies to premarket submissions for cyber devices effective March 29, 2023. Section 331(q)(3) of title 21 makes the failure to comply with any requirement under section 524B(b)(2) a prohibited act.

Section 333(a)(1) of title 21 provides that a person who violates a provision of section 331 is to be imprisoned for not more than one year or fined not more than $1,000, or both. Section 333(a)(2) raises that to imprisonment for not more than three years or a fine of not more than $10,000, or both, for a violation committed after a final conviction or with the intent to defraud or mislead.

Section 333(f)(1)(A) of title 21 makes a person who violates a requirement of the Act that relates to devices liable to the United States for a civil penalty of not more than $15,000 for each violation and not more than $1,000,000 for all violations adjudicated in a single proceeding.

Section 102.3 of title 45 of the Code of Federal Regulations, in the edition revised as of October 1, 2025, lists the 2024 maximum adjusted penalty for that provision as $34,568 for each violation and $2,304,629 for all violations related to devices in a single proceeding. Except as provided in subsection (b) of that section, all proceedings for the enforcement of the Act, or to restrain violations of it, are by and in the name of the United States.

The Food and Drug Administration has issued guidance that addresses its recommendations regarding section 524B for cyber devices. That guidance states that it does not establish any rights for any person and is not binding on FDA or the public.

A derivatives clearing organization shall establish and maintain a program of risk analysis and oversight with respect to its operations and automated systems to identify and minimize sources of operational risk through the development of appropriate controls and procedures and of automated systems that are reliable, secure, and have adequate scalable capacity.

That program must address information security, including controls relating to access to systems and data, vulnerability management, penetration testing, and security incident response and management. A derivatives clearing organization shall follow generally accepted standards and industry best practices with respect to the development, operation, reliability, security, and capacity of automated systems.

A designated contract market's program of risk analysis and oversight with respect to its operations and automated systems shall address each of the following categories of risk analysis and oversight, beginning with enterprise risk management and governance.

A swap execution facility's program of risk analysis and oversight with respect to its operations and automated systems shall address each of the following categories of risk analysis and oversight, beginning with enterprise risk management and governance. A swap execution facility shall conduct regular, periodic, objective testing and review of its automated systems to ensure that they are reliable, secure, and have adequate scalable capacity.

The Commission's system safeguards testing requirements rule at 81 FR 64272 is effective September 19, 2016. The Commission's system safeguards testing requirements rule for derivatives clearing organizations at 81 FR 64322 is effective September 19, 2016.

This subpart applies to the owners and operators of U.S.-flagged vessels, facilities, and OCS facilities required to have a security plan under 33 CFR parts 104, 105, and 106. For each U.S.-flagged vessel, facility, or OCS facility, the owner or operator must ensure a Cybersecurity Plan is developed, approved, and maintained. The owner or operator must designate, in writing, by name and by title, a Cybersecurity Officer who is accessible to the Coast Guard 24 hours a day, 7 days a week.

The owner or operator must ensure the development, approval, and execution of the Cyber Incident Response Plan. Each owner or operator must submit one copy of their Cybersecurity Plan for review and approval to the cognizant Captain of the Port or Officer in Charge, Marine Inspections for a facility or OCS facility, or to the Marine Safety Center for a U.S.-flagged vessel.

The Cybersecurity Officer must ensure that an audit of the Cybersecurity Plan and its implementation is performed annually, beginning no later than 1 year from the initial date of approval. Multifactor authentication must be implemented on password-protected IT and remotely accessible OT systems, and when it is not feasible, appropriate compensating security controls must be implemented and documented.

All personnel with access to the IT or OT systems, including contractors, whether part-time, full-time, temporary, or permanent, must have cybersecurity training. The Cybersecurity Officer must ensure that cybersecurity drills are conducted at least twice each calendar year. The Coast Guard's final rule on cybersecurity in the Marine Transportation System is effective July 16, 2025.

The Cybersecurity Maturity Model Certification Program of the Department of Defense establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information and Controlled Unclassified Information.

The requirements apply to all DoD contract and subcontract awardees that will process, store, or transmit information, in performance of the DoD contract, that meets the standards for Federal Contract Information or Controlled Unclassified Information on contractor information systems. DoD safeguarding policy requires defense contractors and subcontractors to safeguard that information on contractor information systems by applying specified security requirements.

Level 1 uses the safeguarding requirements of 48 CFR 52.204-21, Level 2 uses National Institute of Standards and Technology (NIST) SP 800-171 Revision 2, and Level 3 uses selected security requirements from NIST SP 800-172. A contractor seeking the Final Level 1 (Self) status must achieve a MET result for all Level 1 security requirements. A contractor seeking a Level 2 certification status must obtain a certification assessment from an authorized or accredited CMMC Third-Party Assessment Organization.

A contractor must affirm continuing compliance with the appropriate level self-assessment or certification assessment. A prime contractor must require its subcontractors to comply with and to flow down the CMMC requirements throughout the supply chain at all tiers.

Phase 1 of implementation begins on the effective date of the complementary DFARS acquisition rule, and the Department of Defense intends to include the requirement for a Level 1 or Level 2 self-assessment status in all applicable solicitations and contracts as a condition of contract award. The CMMC Program rule at 32 CFR part 170 is effective December 16, 2024. The complementary DFARS acquisition rule is effective November 10, 2025.

The Safeguards Rule applies to the handling of customer information by all financial institutions over which the Federal Trade Commission has jurisdiction. Those institutions include, among others, mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, tax preparation firms and non-federally insured credit unions.

A covered institution shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of any customer information at issue.

The institution must designate a Qualified Individual responsible for overseeing and implementing its information security program and enforcing it. The program must be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.

The institution must protect by encryption all customer information held or transmitted by it, both in transit over external networks and at rest, unless its Qualified Individual approves effective alternative compensating controls where encryption is infeasible. The institution must implement multi-factor authentication for any individual accessing any information system, unless its Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.

Absent effective continuous monitoring, the institution must conduct annual penetration testing of its information systems and vulnerability assessments at least every six months. The institution must establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in its control.

The institution's Qualified Individual must report in writing, regularly and at least annually, to its board of directors or equivalent governing body. Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. The rule as first adopted took effect on May 23, 2003. The Commission amended the rule in 2021, with the amendments effective January 10, 2022.

The FedRAMP Authorization Act was added to chapter 36 of title 44 of the United States Code by section 5921 of Public Law 117-263 on December 23, 2022. It establishes within the General Services Administration the Federal Risk and Authorization Management Program, a Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.

The Administrator of General Services grants FedRAMP authorizations to cloud computing products and services consistent with the guidance and direction of the FedRAMP Board. Each agency head must promote the use of cloud computing products and services that meet FedRAMP security requirements.

The Director of the Office of Management and Budget must issue guidance that includes requirements for agencies to obtain a FedRAMP authorization when operating a covered cloud computing product or service as a Federal information system. An independent assessment service that performs services described in the Act must annually submit to the Administrator information relating to any foreign interest, foreign influence, or foreign control of the service.

That service must submit an update not later than 48 hours after a change in foreign ownership or control. The repeal of the Act's sections is effective on the date that is 5 years after December 23, 2022.

FAR 52.204-29 and 52.204-30 implement Federal Acquisition Supply Chain Security Act orders in federal contracts. They bind a contractor only through a contract with a federal agency whose solicitation and contract include them. A contractor may not provide or use as part of contract performance a covered article, or a product or service produced or provided by a source, that an applicable FASCSA order prohibits, unless a waiver has been issued.

A covered article includes information technology, including cloud computing services of all types. An offeror searches the System for Award Management for the phrase "FASCSA order" and reviews the solicitation for orders not in SAM. By submitting an offer, an offeror represents that it has conducted a reasonable inquiry and does not propose to provide or use a prohibited covered article or source.

An offeror that cannot make the representation discloses the product or service, the covered article or source, the supplying vendor, brand, model number, item description and the reason it is provided or used, so the Government can decide whether to issue a waiver. During performance the contractor reviews SAM.gov at least once every three months, or as the Contracting Officer advises, for new orders.

A contractor that identifies a covered article or source subject to an order in what it provided to the Government or used in performance, including through notice from a subcontractor at any tier, must report it to the contracting office. The report is due within 3 business days of the identification. Further mitigation information is due within 10 business days after that report.

The report goes to the Contracting Officer, or to the DIBNet website for a Department of Defense contracting office. The contractor inserts the substance of the clause in all subcontracts, including subcontracts for commercial products and commercial services. The changes were issued as an interim rule effective December 4, 2023 and apply to solicitations issued on or after that date.

Subpart C of Part 164 of title 45 of the Code of Federal Regulations requires a covered entity or business associate to comply with its applicable standards, implementation specifications and requirements with respect to electronic protected health information of a covered entity. A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction covered by the subchapter.

A business associate is, with respect to a covered entity, a person who on its behalf creates, receives, maintains, or transmits protected health information for a function or activity the Health Insurance Portability and Accountability Act (HIPAA) rules regulate. The definition of a business associate includes a subcontractor that handles protected health information on behalf of the business associate, and a person that offers a personal health record to one or more individuals on behalf of a covered entity.

The general requirements are to ensure the confidentiality, integrity, and availability of all electronic protected health information the entity creates, receives, maintains, or transmits, to protect against reasonably anticipated threats or hazards to its security or integrity, and to protect against reasonably anticipated uses or disclosures that the Privacy Rule does not permit or require.

An entity may use any security measures that allow it to reasonably and appropriately implement the standards and implementation specifications, and in choosing them must take into account its size, complexity, and capabilities, its technical infrastructure, hardware, and software security capabilities, the costs of security measures, and the probability and criticality of potential risks.

An implementation specification is either required or addressable, and an entity must implement every required one. For an addressable specification an entity must assess whether it is a reasonable and appropriate safeguard in its environment, and implement it if reasonable and appropriate. If implementing it is not reasonable and appropriate, the entity must document why and implement an equivalent alternative measure if reasonable and appropriate.

The mechanism to encrypt and decrypt electronic protected health information is an addressable specification of the access control standard. Encryption of electronically transmitted electronic protected health information whenever deemed appropriate is an addressable specification of the transmission security standard.

The administrative safeguards require an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, and security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level.

The standard on security incident procedures requires an entity to identify and respond to suspected or known security incidents, to mitigate their harmful effects to the extent practicable, and to document the incidents and their outcomes. A business associate contract must provide that the business associate will report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by section 164.410.

Subpart D of Part 164 is the HIPAA Breach Notification Rule, which this jurisdiction records as a privacy row. An entity must retain the documentation the Subpart requires for 6 years from the date of its creation or the date when it last was in effect, whichever is later. A health plan that is not a small health plan, a health care clearinghouse and a covered health care provider had to comply no later than April 20, 2005, and a small health plan no later than April 20, 2006.

In its 2013 omnibus rulemaking under the HITECH Act, the Department modified the Security Rule to extend direct liability for compliance with it to business associates. The Department of Health and Human Services published a notice of proposed rulemaking on January 6, 2025 to modify the Security Rule. The Unified Agenda entry for that rulemaking lists it among Long-Term Actions with final action in July 2027.

The Guidelines apply to customer information maintained by or on behalf of entities over which the Office of the Comptroller of the Currency has authority, which are national banks, Federal savings associations, Federal branches and Federal agencies of foreign banks, and any subsidiaries of such entities except brokers, dealers, persons providing insurance, investment companies, and investment advisers.

The Federal Reserve Board's version applies to customer information maintained by or on behalf of bank holding companies and their nonbank subsidiaries or affiliates, except brokers, dealers, persons providing insurance, investment companies, and investment advisors, for which the Board has supervisory authority.

The Federal Deposit Insurance Corporation's version applies to banks insured by the FDIC other than members of the Federal Reserve System, state savings associations insured by the FDIC, insured state branches of foreign banks, and any subsidiaries of such entities except brokers, dealers, persons providing insurance, investment companies, and investment advisers.

Each national bank or Federal savings association shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to its size and complexity and the nature and scope of its activities.

The board of directors or an appropriate committee of the board of each national bank or Federal savings association shall approve its written information security program and oversee the development, implementation, and maintenance of that program.

Each national bank or Federal savings association shall identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.

Each national bank or Federal savings association must consider whether listed security measures, including access controls, encryption of electronic customer information, monitoring systems to detect attacks and intrusions, and response programs, are appropriate and adopt those it concludes are appropriate.

Each national bank or Federal savings association shall exercise appropriate due diligence in selecting its service providers and require its service providers by contract to implement appropriate measures designed to meet the objectives of the Guidelines. Each national bank or Federal savings association shall report to its board or an appropriate committee of the board at least annually.

The Comptroller may take action under section 39 of the Federal Deposit Insurance Act and the Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the Comptroller. Each national bank or Federal savings association must implement an information security program pursuant to the Guidelines by July 1, 2001.

Each federally insured credit union will develop a written security program within 90 days of the effective date of insurance. The security program will be designed to ensure the security and confidentiality of member records, protect against the anticipated threats or hazards to the security or integrity of such records, and protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member.

The security program will be designed to respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member. The Guidelines state that a comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.

The Guidelines apply to member information maintained by or on behalf of federally insured credit unions. Each credit union must consider whether the listed security measures, which include access controls, encryption of electronic member information, monitoring systems to detect attacks and intrusions, and response programs, are appropriate and adopt those it concludes are appropriate.

A credit union should exercise appropriate due diligence in selecting its service providers and require its service providers by contract to implement appropriate measures designed to meet the objectives of the Guidelines. A credit union should report to its board or an appropriate committee of the board at least annually on the overall status of the information security program and the credit union's compliance with the Guidelines. The rule is effective July 1, 2001.

Each licensee currently licensed to operate a nuclear power plant under part 50 had to submit a cyber security plan that satisfies the section for Commission review and approval by November 23, 2009. Each licensee subject to the section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat.

The licensee shall protect digital computer and communication systems and networks associated with safety-related and important-to-safety functions, security functions, emergency preparedness functions, and support systems and equipment which, if compromised, would adversely impact those functions. The licensee shall establish, implement, and maintain a cyber security program for the protection of the identified assets and incorporate it as a component of the physical protection program.

The cyber security program must be designed to implement security controls and apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. As part of the cyber security program, the licensee shall conduct cyber security event notifications in accordance with the provisions of section 73.77. The cyber security plan must include measures for incident response and recovery for cyber attacks. The Nuclear Regulatory Commission's power reactor security final rule is effective on May 26, 2009.

Division H of Public Law 118-50 makes it unlawful for an entity to distribute, maintain, or update (or enable the distribution, maintenance, or updating of) a foreign adversary controlled application by carrying out, within the land or maritime borders of the United States, either of two acts.

The first act is providing services to distribute, maintain, or update the application, including any source code of the application, by means of a marketplace, including an online mobile application store, through which users within the land or maritime borders of the United States may access, maintain, or update it.

The second act is providing internet hosting services to enable the distribution, maintenance, or updating of the application for users within the land or maritime borders of the United States. A foreign adversary controlled application includes a website, desktop application, mobile application, or augmented or immersive technology application that ByteDance Ltd. operates, directly or indirectly.

It also includes such an application operated by TikTok, or by a subsidiary of or a successor to ByteDance Ltd. or TikTok that is controlled by a foreign adversary. A foreign adversary controlled application also includes the application of a covered company that is controlled by a foreign adversary and that the President determines to present a significant threat to the national security of the United States.

For an application operated by ByteDance Ltd. or TikTok, the prohibition applies beginning on the date that is 270 days after the date of the enactment of the division. For an application of a covered company that the President determines to present a significant threat, the prohibition applies beginning on the date that is 270 days after the date of the relevant determination of the President.

The President may grant a one-time extension of not more than 90 days if the President certifies to Congress that a path to executing a qualified divestiture has been identified, that evidence of significant progress toward it has been produced, and that the relevant binding legal agreements are in place to enable it.

Before the prohibition applies to an application, the entity that owns or controls it must provide, on request by a user within the United States, all the available data related to the user's account, in a machine readable format. The prohibition does not apply to an application with respect to which a qualified divestiture is executed before the date on which the prohibition would begin to apply to it.

The prohibition ceases to apply to an application with respect to which a qualified divestiture is executed after the date on which the prohibition applies to it. A qualified divestiture is a divestiture or similar transaction that the President determines, through an interagency process, would result in the relevant foreign adversary controlled application no longer being controlled by a foreign adversary.

The President must also determine, through an interagency process, that the transaction precludes the establishment or maintenance of any operational relationship between the United States operations of the relevant application and any formerly affiliated entities that are controlled by a foreign adversary, including any cooperation with respect to the operation of a content recommendation algorithm or an agreement with respect to data sharing.

An entity that violates the prohibition is subject to a civil penalty not to exceed the amount that results from multiplying $5,000 by the number of users within the land or maritime borders of the United States determined to have accessed, maintained, or updated a foreign adversary controlled application as a result of the violation.

An entity that violates the data portability duty is subject to a civil penalty not to exceed the amount that results from multiplying $500 by the number of users within the land or maritime borders of the United States affected by the violation. The Attorney General conducts investigations related to potential violations and, if an investigation results in a determination that a violation has occurred, pursues enforcement under the civil penalty provisions.

The Attorney General may bring an action in an appropriate district court of the United States for appropriate relief, including civil penalties and declaratory and injunctive relief. Nothing in the division authorizes the Attorney General to pursue enforcement against an individual user of a foreign adversary controlled application.

The Court of Appeals for the District of Columbia Circuit has exclusive jurisdiction over any challenge to the division or any action, finding, or determination under it. A challenge to the division itself may be brought only not later than 165 days after the date of its enactment. On September 30, 2025, the Federal Register published an Executive Order of September 25, 2025 stating that the Act's prohibitions with respect to ByteDance Ltd. and TikTok became effective on January 19, 2025.

That order directs the Attorney General not to take any action on behalf of the United States to enforce the Act for 120 days from the date of the order.

Every covered institution must develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.

The written policies and procedures must be reasonably designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

The written policies and procedures must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures. The response program must include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.

A covered institution is any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. The amendments to Regulation S-P are effective August 2, 2024. The amendments were published in the Federal Register on June 3, 2024. Compliance was required 18 months after Federal Register publication for larger entities and 24 months after publication for smaller entities.

An SCI entity is an SCI self-regulatory organization, SCI alternative trading system, plan processor, exempt clearing agency subject to ARP, or SCI competing consolidator.

Each SCI entity shall establish, maintain, and enforce written policies and procedures reasonably designed to ensure that its SCI systems and, for purposes of security standards, indirect SCI systems, have levels of capacity, integrity, resiliency, availability, and security, adequate to maintain the SCI entity's operational capability and promote the maintenance of fair and orderly markets.

The policies and procedures must include, at a minimum, regular reviews and testing of the systems, including backup systems, to identify vulnerabilities pertaining to internal and external threats, physical hazards, and natural or manmade disasters. The policies and procedures must also include business continuity and disaster recovery plans reasonably designed to achieve next business day resumption of trading and two-hour resumption of critical SCI systems following a wide-scale disruption.

Policies and procedures are deemed reasonably designed if they are consistent with current SCI industry standards, though compliance with those standards is not the exclusive means of complying. Regulation SCI is effective February 3, 2015. The compliance date of Regulation SCI is nine months after the effective date of the regulation, or November 3, 2015.

Section 302 directs the Commission to require, for each company filing periodic reports under section 13(a) or 15(d) of the Securities Exchange Act of 1934, that the principal executive officer or officers and the principal financial officer or officers, or persons performing similar functions, certify in each annual or quarterly report.

Rule 13a-14 requires each report on Form 10-Q, Form 10-K, Form 20-F or Form 40-F filed under section 13(a) of that Act to include the certifications, other than a report filed by an asset-backed issuer or a report on Form 20-F filed under Rule 13a-19, and requires them to be filed as an exhibit to the report. Each principal executive and principal financial officer of the issuer, or person performing similar functions, at the time of filing of the report must sign a certification.

An officer may not have the certification signed on his or her behalf under a power of attorney or other form of confirming authority.

An asset-backed issuer instead includes with each annual report and transition report on Form 10-K a certification signed by the senior officer in charge of securitization of the depositor if the depositor signs the report, or by the senior officer in charge of the servicing function of the servicer if the servicer signs the report on behalf of the issuing entity. The signing officers certify that they have reviewed the report.

They certify that, based on the officer's knowledge, the report does not contain any untrue statement of a material fact or omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading.

They certify that, based on the officer's knowledge, the financial statements, and other financial information included in the report, fairly present in all material respects the financial condition and results of operations of the issuer as of, and for, the periods presented.

They certify that they are responsible for establishing and maintaining internal controls and have designed those controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to them by others within those entities.

They certify that they have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days before the report, and have presented in the report their conclusions about that effectiveness based on that evaluation.

They certify that they have disclosed to the issuer's auditors and the audit committee of the board of directors, or persons fulfilling the equivalent function, all significant deficiencies in the design or operation of internal controls that could adversely affect the issuer's ability to record, process, summarize, and report financial data, and have identified for the auditors any material weaknesses in internal controls.

They certify that they have disclosed to the same auditors and audit committee any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal controls.

They certify that they have indicated in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls after the date of their evaluation, including any corrective actions regarding significant deficiencies and material weaknesses. The Commission's rule requiring the certifications took effect on August 29, 2002.

A violation of the Act or of a rule of the Commission under it is treated for all purposes in the same manner as a violation of the Securities Exchange Act of 1934. A person who commits such a violation is subject to the same penalties, and to the same extent, as for a violation of the Securities Exchange Act of 1934 or the rules and regulations issued under it.

Section 1519 makes it an offense for whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11.

The offense also reaches the same conduct done in relation to or contemplation of any such matter or case. The section reaches whoever commits the conduct and is not limited to an issuer or to an issuer's records. A person who commits the offense is fined under title 18, imprisoned not more than 20 years, or both. Section 1519 was added to title 18 by section 802(a) of the Sarbanes-Oxley Act, enacted July 30, 2002.

Section 1520(a)(1) requires any accountant who conducts an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 applies to maintain all audit or review workpapers for a period of 5 years from the end of the fiscal period in which the audit or review was concluded.

Section 1520(a)(2) directs the Commission to promulgate rules and regulations relating to the retention of relevant records such as workpapers, documents that form the basis of an audit or review, memoranda, correspondence, communications, other documents, and records, including electronic records.

Rule 2-06 of Regulation S-X requires the accountant to retain, for a period of seven years after concluding an audit or review of an issuer's financial statements, records relevant to the audit or review, including workpapers and other documents that form the basis of the audit or review.

The records include memoranda, correspondence, communications, other documents, and records, including electronic records, that are created, sent or received in connection with the audit or review and contain conclusions, opinions, analyses, or financial data related to it.

For the rule, workpapers means documentation of auditing or review procedures applied, evidence obtained, and conclusions reached by the accountant in the audit or review engagement, as required by standards established or adopted by the Commission or by the Public Company Accounting Oversight Board.

The accountant must retain those records whether they support the auditor's final conclusions or contain information or data, relating to a significant matter, that is inconsistent with the auditor's final conclusions regarding that matter or the audit or review. The records include those documenting a consultation on or resolution of differences in professional judgment. The rule defines an issuer by reference to section 10A(f) of the Securities Exchange Act of 1934.

A person who knowingly and willfully violates section 1520(a)(1), or a rule or regulation the Commission promulgated under section 1520(a)(2), is fined under title 18, imprisoned not more than 10 years, or both. Section 1520 does not diminish or relieve any person of any other duty or obligation imposed by Federal or State law or regulation to maintain, or refrain from destroying, any document. Section 1520 was added to title 18 by section 802(a) of the Sarbanes-Oxley Act, enacted July 30, 2002. The Commission's Rule 2-06 took effect on March 3, 2003, with a compliance date of October 31, 2003.

For this purpose an issuer is an issuer whose securities are registered under section 12 of the Securities Exchange Act of 1934, one that is required to file reports under section 15(d) of that Act, or one that files or has filed a registration statement under the Securities Act of 1933 that has not yet become effective and that it has not withdrawn.

Subsection (a) of section 7262 of title 15 requires each annual report of an issuer to contain an internal control report that states the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. The same report must contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.

Rule 13a-15 requires an issuer's management, with the participation of the principal executive and principal financial officers, to evaluate the effectiveness of internal control over financial reporting as of the end of each fiscal year. The evaluation is required of an issuer that either had been required to file an annual report for the prior fiscal year or previously had filed one with the Commission, other than a registered investment company.

The framework on which that evaluation is based must be a suitable, recognized control framework established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. An evaluation conducted in accordance with the interpretive guidance the Commission issued in release 34-55929 satisfies the evaluation the rule requires.

Internal control over financial reporting is a process designed by or under the supervision of the issuer's principal executive and principal financial officers, and effected by its board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

That definition includes policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer. Rule 13a-15 also requires the issuer to maintain disclosure controls and procedures.

Disclosure controls and procedures are controls and other procedures of an issuer that are designed to ensure that information required to be disclosed in its Exchange Act reports is recorded, processed, summarized and reported within the time periods the Commission's rules and forms specify.

Management must evaluate the effectiveness of those disclosure controls and procedures as of the end of each fiscal quarter, except that a foreign private issuer does so as of the end of each fiscal year and a registered investment company does so within the 90-day period before the filing date of each report requiring certification under Rule 30a-2. Rule 13a-15 does not reach an asset-backed issuer, a small business investment company registered on Form N-5, or a unit investment trust.

Item 308(a) of Regulation S-K requires management's annual report to contain a statement identifying the framework used by management to evaluate the effectiveness of the issuer's internal control over financial reporting. It must also contain management's assessment of effectiveness as of the end of the most recent fiscal year, including a statement whether or not internal control over financial reporting is effective, and disclosure of any material weakness identified by management.

Management is not permitted to conclude that internal control over financial reporting is effective if there are one or more material weaknesses. The issuer must maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of its internal control over financial reporting.

Subsection (b) requires each registered public accounting firm that prepares or issues the audit report for the issuer to attest to, and report on, the assessment made by the management of the issuer. The Board is the Public Company Accounting Oversight Board established under section 7211 of title 15. The firm makes that attestation in accordance with standards for attestation engagements issued or adopted by the Board, and the attestation is not the subject of a separate engagement.

Subsection (b) does not apply to an issuer that is an emerging growth company. Public Law 112-106 added that exclusion to subsection (b) in 2012. Subsection (b) does not apply to an audit report prepared for an issuer that is neither a large accelerated filer nor an accelerated filer as the Commission's Rule 12b-2 defines those terms. Public Law 111-203 added that exemption as subsection (c) in 2010.

Item 308(b) of Regulation S-K requires an accelerated filer or a large accelerated filer that is not an emerging growth company to provide the registered public accounting firm's attestation report on its internal control over financial reporting in its annual report. Item 308(c) requires the issuer to disclose any change in its internal control over financial reporting during its last fiscal quarter that has materially affected, or is reasonably likely to materially affect, that control.

A newly public issuer need not comply with Item 308(a) and (b) until it either had been required to file an annual report for the prior fiscal year or had filed one with the Commission for the prior fiscal year. The Commission's rules took effect on August 14, 2003. An accelerated filer first had to comply with the management report and the registered public accounting firm report requirement for its first fiscal year ending on or after November 15, 2004.

A violation of the Act or of a rule of the Commission under it is treated for all purposes in the same manner as a violation of the Securities Exchange Act of 1934. A person who commits such a violation is subject to the same penalties, and to the same extent, as for a violation of the Securities Exchange Act of 1934 or the rules and regulations issued under it.

The provision binds every issuer that has a class of securities registered under section 12 of the Securities Exchange Act of 1934 and every issuer that is required to file reports under section 15(d) of that Act. Such an issuer must devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances of four matters.

The system must be sufficient to provide reasonable assurances that transactions are executed in accordance with management's general or specific authorization. The system must also be sufficient to provide reasonable assurances that transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and to maintain accountability for assets.

The system must also be sufficient to provide reasonable assurances that access to assets is permitted only in accordance with management's general or specific authorization. The system must also be sufficient to provide reasonable assurances that the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.

A derivatives clearing organization shall notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment, of automated system operation, reliability, security, or capacity.

A designated contract market must notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity. A swap execution facility shall notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity.

A derivatives clearing organization shall provide staff of the Division of Clearing and Risk timely advance notice of all material planned changes to its automated systems that may impact the reliability, security, or capacity of such systems. The Commission's system safeguards testing requirements rule for derivatives clearing organizations at 81 FR 64322 is effective September 19, 2016.

For entities that have not reported to the Coast Guard pursuant to, or are not subject to, 33 CFR 6.16-1, the owner or operator must ensure all reportable cyber incidents are reported to the National Response Center.

A reportable cyber incident is an incident that leads to or, if still under investigation, could reasonably lead to a substantial loss of confidentiality, integrity, or availability of a covered information system, network, or OT system, a disruption or significant adverse impact on the reporting entity's ability to engage in business operations or deliver goods or services, disclosure or unauthorized access to nonpublic personal information of a significant number of individuals, other potential operational disruption to critical infrastructure systems or assets, or incidents that otherwise may lead to a transportation security incident.

The Cybersecurity Officer must ensure all reportable cyber incidents are recorded and reported to the owner or operator. The Cybersecurity Plan must contain cyber incident reporting procedures in accordance with part 101.

Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility shall be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives. The Coast Guard's final rule on cybersecurity in the Marine Transportation System is effective July 16, 2025.

The Comptroller of the Currency, the Federal Reserve Board, and the Federal Deposit Insurance Corporation issued this Computer-Security Incident Notification rule as one joint final rule, codified in parallel at 12 CFR Part 53 for the Comptroller, 12 CFR Part 225, Subpart N for the Board, and 12 CFR Part 304, Subpart C for the Corporation. For the Comptroller, a banking organization is a national bank, Federal savings association, or Federal branch or agency of a foreign bank.

For the Board, a banking organization is a bank holding company, savings and loan holding company, state member bank, the United States operations of a foreign banking organization, or an Edge or agreement corporation. For the Corporation, a banking organization is an insured state nonmember bank, insured state licensed branch of a foreign bank, or insured State savings association.

None of the three agencies treats a designated financial market utility as a banking organization or as a bank service provider. A bank service provider is a bank service company or other person that performs covered services under the Bank Service Company Act. A computer-security incident is any occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.

A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's ability to carry out banking operations, activities, or processes, or to deliver banking products and services to a material portion of its customer base, a business line whose failure would result in a material loss of revenue, profit, or franchise value, or operations whose failure or discontinuance would threaten the financial stability of the United States.

A banking organization must notify its primary federal regulator about a notification incident as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

A bank service provider must separately notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for four or more hours.

This bank service provider notification duty does not apply to scheduled maintenance, testing, or a software update previously communicated to the banking organization customer. The rule's own regulatory text became effective on April 1, 2022. Both notification duties began binding their subjects on the May 1, 2022 compliance date.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a federal statute enacted March 15, 2022 that would require a covered entity to report a covered cyber incident and a ransom payment to the Cybersecurity and Infrastructure Security Agency. A covered entity must report a covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes the incident has occurred.

A covered entity that makes a ransom payment must report the payment to the Agency not later than 24 hours after the payment is made, even where the underlying attack is not itself a covered cyber incident. A covered entity must also submit a prompt supplemental report whenever substantial new information becomes available or a later ransom payment is made, continuing until the covered entity reports the incident concluded, and must preserve data relevant to the incident or payment.

The statute leaves the definition of covered entity, and the effective date of all four of these duties, to a final rule the Agency must issue. The Agency published a notice of proposed rulemaking on April 4, 2024 at 89 FR 23644, docket CISA-2022-0010, proposing to define covered entity by a small-business size standard or by one of several sector-based criteria across sixteen critical infrastructure sectors.

The statute required the Agency to issue the final rule not later than 18 months after that publication, a deadline of October 4, 2025, and the Agency has not met it. As of September 20, 2026 the Agency has not published a final rule, and its own published status page states that it continues to work on the final rule after multiple lapses in its own funding disrupted the rulemaking.

Until the final rule takes effect none of these four duties binds anyone, and the Agency asks entities only to volunteer cyber incident information in the meantime.

The proposed rule states that a cloud service provider or a managed service provider is not itself obligated to report merely because a compromise of its own systems caused the impact at a customer, since the reporting duty runs to the covered entity whose systems were affected rather than to the vendor, unless that vendor independently meets the covered-entity criteria in its own right.

A federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe.

The NCUA must receive the notification as soon as possible but no later than 72 hours after the credit union reasonably believes that it has experienced a reportable cyber incident or, if the incident arises through a third party, within 72 hours of being notified by the third party, whichever is sooner.

A reportable cyber incident includes a substantial cyber incident that leads to a substantial loss of confidentiality, integrity, or availability of a network or member information system that results from the unauthorized access to or exposure of sensitive data, disrupts vital member services, or has a serious impact on the safety and resiliency of operational systems and processes.

A reportable cyber incident also includes a substantial cyber incident that leads to a disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.

A reportable cyber incident further includes a substantial cyber incident that leads to a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.

A reportable cyber incident does not include any event where the cyber incident is performed in good faith by an entity in response to a specific request by the owner or operators of the system. The final rule is effective September 1, 2023.

Each licensee subject to the provisions of section 73.54 or section 73.110 shall notify the NRC Headquarters Operations Center via the Emergency Notification System.

Notification is due within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions, or that compromised support systems and equipment resulting in adverse impacts to safety, security, or emergency preparedness functions within the scope of section 73.54.

Notification is also due within one hour after discovery of a cyberattack that adversely impacted safety, security, and emergency preparedness functions performed by digital assets that prevent a postulated fission product release resulting in offsite doses exceeding the values in section 53.210 of this chapter, or security functions performed by digital assets necessary for implementing the physical security requirements in section 53.860(a) of this chapter.

Notification is due within 4 hours after discovery of a cyberattack that could have caused an adverse impact to safety-related or important-to-safety functions, security functions, or emergency preparedness functions. Notification is due within 4 hours after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to digital computer and communication systems and networks within the scope of section 73.54 or section 73.110.

Notification is due within 8 hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against digital computer and communication systems and networks within the scope of section 73.54 or section 73.110.

The licensee shall use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in its section 73.54 or section 73.110 cybersecurity program within 24 hours of their discovery. The Nuclear Regulatory Commission's cyber security event notification rule is effective December 2, 2015.

Compliance with the rule was required by May 2, 2016 for those licensed to operate under parts 50 and 52 of title 10 of the Code of Federal Regulations and subject to section 73.54. The Commission's 2026 final rule establishing a technology-inclusive framework for commercial nuclear plants, which amended section 73.77 to reach licensees subject to section 73.110, is effective April 29, 2026.

An Securities and Exchange Commission (SEC) reporting company must describe, in its annual report under Regulation S-K Item 106, its processes for assessing and managing cybersecurity risk. It must also describe its board's and management's oversight of that risk. This duty applies beginning with annual reports for fiscal years ending on or after December 15, 2023. Under Item 1.05 of Form 8-K, the same company must determine, without unreasonable delay after discovering a cybersecurity incident, whether the incident is material.

If the incident is material, the company must file a Form 8-K describing it within four business days of that determination. The United States Attorney General may authorize a delay of up to 30 days, and a further 30 days, where disclosure would pose a substantial risk to national security or public safety, and in extraordinary circumstances a final 60 days where the continuing risk is to national security, up to 120 days in total.

Registrants other than smaller reporting companies had to comply with Item 1.05 from December 18, 2023, and smaller reporting companies from June 15, 2024.

A covered institution's response program must include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers.

Those policies and procedures must be reasonably designed to ensure service providers provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of such notification, the covered institution must initiate its incident response program.

A covered institution may enter into a written agreement with its service provider to notify affected individuals on the covered institution's behalf. A service provider is any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution. Compliance was required 18 months after Federal Register publication for larger entities and 24 months after publication for smaller entities.

Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, each SCI entity shall notify the Commission of the SCI event immediately. Within 24 hours of any responsible SCI personnel having a reasonable basis to conclude that the SCI event has occurred, the SCI entity shall submit a written notification to the Commission, made on a good faith, best efforts basis.

Until the SCI event is resolved and the investigation is closed, the SCI entity shall provide updates to the Commission on a regular basis, or at such frequency as reasonably requested by a representative of the Commission. If an SCI event is resolved and the investigation closed within 30 calendar days of its occurrence, the SCI entity shall submit a final written notification within five business days after the resolution and closure.

An SCI event that has had, or is reasonably estimated to have, no or a de minimis impact is reported in a summary report within 30 calendar days after the end of each calendar quarter. An SCI event means an event at an SCI entity that constitutes a systems disruption, a systems compliance issue, or a systems intrusion.

Promptly after responsible SCI personnel have a reasonable basis to conclude that an SCI event that is a systems disruption or systems compliance issue has occurred, the SCI entity shall disseminate the system or systems affected and a summary description of the SCI event.

The information disseminated must go promptly to the members or participants of the SCI entity that responsible SCI personnel reasonably estimate may have been affected, and for major SCI events to all of its members or participants. Regulation SCI is effective February 3, 2015. The compliance date of Regulation SCI is nine months after the effective date of the regulation, or November 3, 2015.

The clause requires a contractor to provide adequate security on every covered contractor information system that processes, stores, or transmits covered defense information. For a system that is not part of an information technology service the government operates on its own behalf, that duty means implementing the safeguards in National Institute of Standards and Technology (NIST) Special Publication 800-171. The contractor must rapidly report a cyber incident, defined as reporting within 72 hours of discovery of the incident.

That report is made to the Department of Defense at its DIBNet portal, dibnet.dod.mil. Filing that report requires a DoD-approved medium assurance certificate. The contractor must preserve and protect forensic images of the affected information systems and related monitoring and packet-capture data for at least 90 days from the date it submits the cyber incident report.

Malicious software isolated in connection with a reported incident must be submitted to the Department of Defense Cyber Crime Center rather than to the contracting officer. The clause must be included without alteration in a subcontract that involves covered defense information or operationally critical support, including a subcontract for a commercial product or service.

A contractor using an external cloud service provider must require that provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with the clause's duties on incident reporting, malicious software, media preservation, forensic access, and damage assessment.

The CAN-SPAM Act uses an opt-out model: a sender may transmit a commercial electronic mail message without the recipient's prior consent, so long as the message carries accurate header and routing information, a non-deceptive subject line, clear and conspicuous identification that it is an advertisement (unless the recipient gave prior affirmative consent), a functioning opt-out mechanism, and a valid physical postal address, and the sender stops messages within 10 business days of an opt-out request.

A transactional or relationship message, one that facilitates an already-agreed transaction or delivers warranty, safety, or entitled-goods information, is exempt from these commercial-message duties under 16 CFR 316.3 unless a recipient would reasonably conclude its primary purpose is commercial. Aggravated violations, address harvesting, dictionary attacks, and falsified domain registration used to send the mail, carry heightened damages.

The Act is enforced by the Federal Trade Commission as an unfair or deceptive act or practice and by certain sector regulators; it gives no individual recipient a private right of action, but a State attorney general suing as parens patriae for its residents, or an Internet access service provider adversely affected by a violation, may recover statutory damages without proving loss.

Unlike the CAN-SPAM Act's opt-out model for ordinary commercial email, this Federal Communications Commission rule requires opt-in consent before sending a commercial message to an address that resolves to a domain the Commission has listed as a wireless carrier's messaging gateway.

The sender must have the addressee's express prior authorization, obtainable in writing (including electronically) or orally, naming the sender and the address to be messaged, and must stop sending further messages within 10 days of a request to stop.

Section 201(a) of the Communications Act makes it the duty of every common carrier engaged in interstate or foreign communication by wire or radio to furnish communication service upon reasonable request. Section 201(b) declares unlawful any charge, practice, classification, or regulation in connection with that service that is unjust or unreasonable.

Section 202(a) makes it unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities, or services for or in connection with like communication service. These duties are laid on the common carrier that provides the communication service.

A telecommunications carrier, which is any provider of telecommunications services, is treated as a common carrier only to the extent that it is engaged in providing telecommunications services. Telecommunications service is the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

An information service is the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications. The Communications Act of 1934 took effect upon the organization of the Federal Communications Commission, except sections 1 and 4, which took effect July 1, 1934.

The Communications Assistance for Law Enforcement Act requires a telecommunications carrier to ensure that its equipment, facilities or services that provide a customer or subscriber with the ability to originate, terminate or direct communications are capable of isolating a subscriber's communications and call-identifying information and delivering them to the government under a court order or other lawful authorization.

A telecommunications carrier is a person or entity engaged in the transmission or switching of wire or electronic communications as a common carrier for hire, and includes a provider of commercial mobile service and a provider of wire or electronic communication switching or transmission service that the Commission finds is a replacement for a substantial portion of the local telephone exchange service and that it is in the public interest to deem a carrier.

The term does not include a person or entity insofar as it is engaged in providing information services. The Federal Communications Commission ruled in 2005 that providers of facilities-based broadband Internet access services and providers of interconnected voice over Internet Protocol services, meaning VoIP service that allows a user generally to receive calls originating from and to terminate calls to the public switched telephone network, must comply with the Act.

The Commission required those carriers to be in compliance with the assistance capability requirements of section 103 of the Act by May 14, 2007. A carrier may satisfy the assistance capability requirements by complying with publicly available technical requirements or standards adopted by an industry association or standard-setting organization, or by the Commission.

The assistance capability requirements do not apply to information services, or to equipment, facilities or services that support the transport or switching of communications for private networks or for the sole purpose of interconnecting telecommunications carriers.

A carrier is not responsible for decrypting, or ensuring the government's ability to decrypt, a communication encrypted by a subscriber or customer, unless the carrier provided the encryption and possesses the information necessary to decrypt the communication.

A carrier must ensure that any interception of communications or access to call-identifying information effected within its switching premises can be activated only in accordance with a court order or other lawful authorization and with the affirmative intervention of an individual officer or employee of the carrier. The Commission's rules require a carrier to appoint a senior officer or employee responsible for ensuring that duty is met.

A carrier must maintain a secure and accurate record of each interception of communications or access to call-identifying information, made with or without appropriate authorization. A carrier must report to the affected law enforcement agencies, within a reasonable time upon discovery, any act of compromise of a lawful interception and any act of unlawful electronic surveillance that occurred on its premises.

A manufacturer of telecommunications transmission or switching equipment and a provider of telecommunications support services must, on a reasonably timely basis and at a reasonable charge, make available to carriers the features or modifications necessary to permit them to comply with the capability requirements.

A court issuing an enforcement order against a carrier, a manufacturer of transmission or switching equipment or a provider of telecommunications support services may impose a civil penalty of up to $10,000 per day for each day in violation after the order issues or after a later date the court specifies. For a carrier's violation of the Commission's rules in the subpart, the Commission enforces the penalties articulated in section 503(b) of the Communications Act of 1934 and 47 CFR 1.80.

It is unlawful to intentionally intercept, or procure another person to intercept, a wire, oral, or electronic communication, but federal law requires the consent of only one party to the communication: a person who is themselves a party to the call, or who has the prior consent of one of the parties, may record or disclose it without the other party's knowledge, unless the interception is for the purpose of committing a crime or a tort.

A person whose communication is intercepted, disclosed, or used in violation of this chapter has a civil action for the greater of actual damages plus the violator's profits, or statutory damages of $100 a day per violation or $10,000, whichever is greater, plus punitive damages and attorney's fees. An intentional violation is also a federal crime punishable by a fine or up to five years' imprisonment. The provisions this entry describes came into force on different days.

Subpart HH of 47 CFR part 64 required a voice service provider, not later than June 30, 2021, to fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks, subject to the extensions and exemptions the subpart gives. The provider must authenticate caller identification information for all SIP calls it originates and will exchange with another provider.

It must verify caller identification information for the SIP calls it receives from another provider and will terminate, when that information has been authenticated. Each intermediate provider must also fully implement the STIR/SHAKEN authentication framework in its internet Protocol networks.

A gateway provider must authenticate caller identification information for the calls it receives that use North American Numbering Plan resources that pertain to the United States in the caller ID field and have not been authenticated. Each voice service provider must implement an appropriate robocall mitigation program that includes a commitment to respond within 24 hours to all traceback requests from the Commission, law enforcement, and the industry traceback consortium.

A voice service provider must certify in the Robocall Mitigation Database that all of the calls it originates are subject to a robocall mitigation program. Providers of voice service are prohibited from adding any additional line item charges to consumer or small business customer subscribers for the call authentication technology.

Voice service is any service that is interconnected with the public switched telephone network and furnishes voice communications to an end user using resources from the North American Numbering Plan.

The Federal Trade Commission's Telemarketing Sales Rule requires a seller or telemarketer to screen outbound calls against the National Do Not Call Registry (for which access carries an annual per-area-code fee) and its own do-not-call list, caps abandoned calls, and conditions a prerecorded telemarketing message on the recipient's prior signed written agreement to receive it.

The Federal Trade Commission enforces the Rule as an unfair or deceptive act or practice, with the Federal Trade Commission Act's civil penalty. Separately, 15 U.S.C. 6104 lets a person adversely affected by a pattern or practice of telemarketing that violates the Rule sue for an injunction or damages, but only where the amount in controversy exceeds $50,000 in actual damages for each person affected; the statute gives no fixed per-violation amount, unlike the Telephone Consumer Protection Act (TCPA)'s private right. The provisions this entry describes came into force on different days.

The Telephone Consumer Protection Act prohibits a call or text using an automatic telephone dialing system or an artificial or prerecorded voice to a wireless number without the called party's prior express consent, and a prerecorded-voice call to a residential line without that consent. The Federal Communications Commission's implementing rule requires the seller to have obtained the recipient's prior express written consent before a telemarketing robocall or robotext is sent.

The Commission's declaratory ruling released February 8, 2024 confirms that the statute's restrictions on an artificial or prerecorded voice encompass current artificial intelligence technologies that generate human voices. A caller that uses such a technology must obtain the called party's prior express consent to initiate the call, absent an emergency purpose or exemption.

The Fifth Circuit has held that, contrary to the Commission's regulation, the statute permits either written or oral consent for any autodialed or prerecorded call. A called party may revoke that consent at any time by any reasonable method. The caller must honor the revocation within a reasonable time not to exceed ten business days.

The Commission has waived enforcement of the part of this revocation rule that would apply a revocation made about one type of message to all of a caller's future messages, through January 31, 2027. A Commission rule published October 26, 2026 and effective November 25, 2026 lets a caller designate an automated opt-out mechanism, a reply using a standardized word such as stop, or a website or telephone number as the exclusive means to revoke consent.

The caller must disclose the designated method clearly and conspicuously on the call or in the text. That rule also lets a caller treat a revocation made in response to an informational call or text as applying only to the specific category of informational calls and texts to which it was directed. A revocation made in response to a call or text that contains an advertisement or constitutes telemarketing revokes consent to all such future calls and texts from that caller.

The rule supersedes the waiver from its effective date. Section 227(b)(3) gives a person harmed by a violation a private right of action in state court for the greater of actual monetary loss or $500 in damages per violation, trebled at the court's discretion for a willful or knowing violation.

Section 227(c) directed the Federal Communications Commission to protect residential subscribers from unwanted telephone solicitations, and 47 CFR 64.1200(c) bars a telephone solicitation to a residential subscriber before 8 a.m. or after 9 p.m. local time at the called party's location, or to a subscriber registered on the National Do Not Call Registry, unless the subscriber has an established business relationship with the caller or has given signed written permission to be called.

47 CFR 64.1200(d) separately requires anyone making telemarketing calls to maintain a written company-specific do-not-call policy, train personnel in it, and honor an individual's own request not to be called within a reasonable time not to exceed ten business days.

47 CFR 64.1200(e) applies these rules to a person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers, to the extent described in the Commission's Report and Order that the rule names.

A person who has received more than one call from the same entity within a 12-month period in violation of these rules may bring a private action in state court for the greater of actual monetary loss or $500 per violation, trebled at the court's discretion for a willful or knowing violation, a different trigger from the single-call private right under section 227(b)(3).

The Seventh Circuit has held that texts are not calls, so the private right of action in section 227(c)(5) does not authorize a suit over unwanted text messages.

Section 227(b)(1)(C) makes it unlawful to use a telephone facsimile machine, computer or other device to send an unsolicited advertisement to a telephone facsimile machine unless an exception applies. An unsolicited advertisement is any material advertising the commercial availability or quality of any property, goods or services that is transmitted to any person without that person's prior express invitation or permission, in writing or otherwise.

The exception covers an advertisement from a sender with an established business relationship with the recipient, whose fax number came through the recipient's voluntary communication within that relationship or from a directory, advertisement or Internet site on which the recipient voluntarily agreed to make the number available for public distribution.

The exception applies only if the advertisement also carries the required opt-out notice, and it does not apply to a sender that has received a request not to send future unsolicited advertisements to that fax machine.

For this rule an established business relationship is a prior or existing relationship formed by a voluntary two-way communication between a person or entity and a business or residential subscriber, with or without an exchange of consideration, on the basis of an inquiry, application, purchase or transaction regarding the products or services the person or entity offers, which neither party has ended. The notice must be clear and conspicuous and on the first page of the advertisement.

The notice must state that the recipient may ask the sender not to send future advertisements to a telephone facsimile machine and that failure to comply with such a request within 30 days is unlawful. The notice must give a domestic contact telephone number and facsimile machine number for the request and, if neither is a toll-free number, a separate cost-free mechanism such as a Web site address or email address.

The numbers and the cost-free mechanism in the notice must permit a request to be made 24 hours a day, 7 days a week. A sender that receives a compliant request not to send future unsolicited advertisements must honor it within the shortest reasonable time from the date of the request, not to exceed 30 days. The recipient's opt-out request terminates the established business relationship exemption for purposes of sending future unsolicited advertisements.

A facsimile broadcaster is liable for violations of this rule if it demonstrates a high degree of involvement in, or actual notice of, the unlawful activity and fails to take steps to prevent such facsimile transmissions. Section 227(b)(3) gives a person harmed by a violation a private right of action in state court for the greater of actual monetary loss or $500 in damages per violation, trebled at the court's discretion for a willful or knowing violation.

It is unlawful for any person, in connection with a voice call or text message, to cause a caller identification service to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value; the subsection does not restrict a caller from blocking its own caller ID. Its enforcement provisions name a Federal Communications Commission forfeiture, a criminal fine and a State attorney general's civil action, and give no private suit.

A violation is punishable by a Federal Communications Commission forfeiture of up to $10,000 per violation, trebled for each day of a continuing violation and capped at $1,000,000 for any single act, and by a criminal fine of up to $10,000 per violation for a willful and knowing violation.

Section 230 of the Communications Act of 1934 provides that no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

Section 230 also provides that no provider or user shall be held liable on account of any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected.

An interactive computer service is any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server.

The protection in subsection (c)(1) reaches only information provided by another information content provider, which subsection (f)(3) defines as any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.

A provider of interactive computer service must, at the time of entering an agreement with a customer for the provision of interactive computer service and in a manner deemed appropriate by the provider, notify the customer that parental control protections are commercially available that may assist the customer in limiting access to material that is harmful to minors.

Nothing in section 230 impairs the enforcement of section 223 or 231 of title 47, chapter 71 or chapter 110 of title 18, or any other federal criminal statute. Nothing in section 230 limits or expands any law pertaining to intellectual property. Nothing in section 230 limits the application of the Electronic Communications Privacy Act of 1986 or any similar State law.

Nothing in section 230, other than subsection (c)(2)(A), impairs or limits a civil action under section 1595 of title 18 where the conduct underlying the claim violates section 1591 of that title, or a State criminal prosecution where the conduct underlying the charge would violate section 1591 of title 18, or would violate section 2421A of title 18 and promotion or facilitation of prostitution is illegal in the jurisdiction where the defendant's promotion or facilitation of prostitution was targeted.

Subsection (e)(5) was added by Public Law 115-164 in 2018. That amendment took effect on April 11, 2018, regardless of whether the conduct alleged occurred before, on, or after that date. No cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with section 230, although a State may enforce a State law that is consistent with it. The provisions this entry describes came into force on different days.

Section 2333(a) lets any national of the United States injured in his or her person, property, or business by reason of an act of international terrorism, or his or her estate, survivors, or heirs, sue in any appropriate district court of the United States and recover threefold the damages he or she sustains and the cost of the suit, including attorney's fees.

Subsection (d)(2) extends that action, where the injury arose from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization under section 219 of the Immigration and Nationality Act as of the date on which the act was committed, planned, or authorized, to any person who aids and abets, by knowingly providing substantial assistance, or who conspires with the person who committed the act.

Subsection (d)(1) gives the term person the meaning it has in section 1 of title 1. That definition includes corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individuals. Section 4 of Public Law 114-222 added subsection (d) to section 2333 in 2016. Public Law 114-222 may be cited as the Justice Against Sponsors of Terrorism Act.

The amendments made by that Act apply to any civil action pending on, or commenced on or after, September 28, 2016, arising out of an injury to a person, property, or business on or after September 11, 2001.

Section 512 of title 17 limits the liability of a service provider for infringement of copyright in four situations, which it describes as separate and distinct functions: transitory digital network communications in subsection (a), system caching in subsection (b), information residing on systems or networks at the direction of users in subsection (c), and information location tools in subsection (d).

A service provider that stores material at the direction of a user is not liable for monetary relief, or, except as provided in subsection (j), for injunctive or other equitable relief, for infringement of copyright by reason of that storage if it meets the conditions of subsection (c)(1).

To qualify under subsection (c), a provider must have no actual knowledge that the material or an activity using the material is infringing, must not be aware of facts or circumstances from which infringing activity is apparent, or on obtaining such knowledge or awareness must act expeditiously to remove, or disable access to, the material.

To qualify under subsection (c), a provider must also not receive a financial benefit directly attributable to the infringing activity in a case in which it has the right and ability to control that activity. To qualify under subsection (c), a provider must also, on notification of claimed infringement as described in paragraph (3), respond expeditiously to remove, or disable access to, the material that is claimed to be infringing or to be the subject of infringing activity.

The subsection (c) limitations apply to a service provider only if it has designated an agent to receive notifications of claimed infringement, by making the agent's name, address, phone number and electronic mail address available through its service, including on its website in a location accessible to the public, and by providing that information to the Copyright Office.

The Copyright Office's rule requires a service provider to designate its agent electronically, through the online registration system on the Office's website. A designation expires and becomes invalid three years after it is registered, unless the service provider renews it by amending it to correct or update information or by resubmitting it without amendment.

To be effective, a notification of claimed infringement must be a written communication provided to the designated agent that includes substantially the following: the signature of a person authorized to act for the owner of an exclusive right, identification of the copyrighted work, identification and location of the material, contact information for the complaining party, a statement of good faith belief that the use is not authorized by the copyright owner, its agent, or the law, and a statement that the information is accurate and, under penalty of perjury, that the complaining party is authorized to act.

A notification that fails to comply substantially with the elements of subsection (c)(3)(A) is not considered in determining whether a service provider has actual knowledge or is aware of facts or circumstances from which infringing activity is apparent.

If a notification substantially complies with clauses (ii), (iii), and (iv) of subsection (c)(3)(A), which cover the identification of the work, the identification of the material and the contact information for the complaining party, the provider may disregard it in determining actual knowledge or awareness only if it promptly attempts to contact the person making it or takes other reasonable steps to assist in the receipt of a notification that substantially complies with all the elements.

A service provider is not liable to any person for a claim based on its good faith disabling of access to, or removal of, material claimed to be infringing, regardless of whether the material is ultimately determined to be infringing.

For material that a subscriber stored and that the provider removed on a notification, the protection from liability for the removal applies only if the provider promptly takes reasonable steps to notify the subscriber, gives the complainant a copy of any counter notification and says it will replace the material in 10 business days, and replaces the material not less than 10, nor more than 14, business days after receiving the counter notice unless its designated agent first receives notice that the complainant has filed an action seeking a court order to restrain the subscriber.

The section 512 limitations apply to a service provider only if it has adopted and reasonably implemented, and informs subscribers and account holders of, a policy that provides for the termination in appropriate circumstances of subscribers and account holders who are repeat infringers, and accommodates and does not interfere with standard technical measures.

Section 512 does not condition subsections (a) through (d) on a service provider monitoring its service or affirmatively seeking facts indicating infringing activity, except to the extent consistent with a standard technical measure.

A service provider is not liable for referring or linking users to an online location containing infringing material or infringing activity by using information location tools, including a directory, index, reference, pointer, or hypertext link, if it meets the conditions in paragraphs (1) through (3) of subsection (d).

A copyright owner or a person authorized to act on the owner's behalf may request the clerk of any United States district court to issue a subpoena to a service provider for identification of an alleged infringer.

On receipt of the issued subpoena, the service provider must expeditiously disclose to the copyright owner or the person the owner authorized the information the subpoena requires, notwithstanding any other provision of law and regardless of whether the service provider responds to the notification.

Any person who knowingly materially misrepresents under section 512 that material or activity is infringing, or that it was removed or disabled by mistake or misidentification, is liable for any damages, including costs and attorneys' fees, incurred by the alleged infringer, by a copyright owner or the owner's authorized licensee, or by a service provider who is injured by the misrepresentation as a result of the service provider relying on it.

Criminalizes the knowing nonconsensual publication of an intimate visual depiction of an identifiable individual, including an AI-generated depiction, and requires covered platforms to establish a process to remove such content within 48 hours of a valid request from the depicted individual or their representative, enforced by the FTC as an unfair or deceptive practice. The Act's criminal prohibition on nonconsensual publication took effect immediately upon its enactment on May 19, 2025.

The Section 3 platform notice-and-removal duty described by this row's own penalty and enforcement fields did not take effect until May 19, 2026, one year after enactment.

Section 2421A of title 18 makes it a federal crime for a person who, using a facility or means of interstate or foreign commerce or in or affecting interstate or foreign commerce, owns, manages, or operates an interactive computer service, or conspires or attempts to do so, to act with the intent to promote or facilitate the prostitution of another person.

Subsection (b) treats the offense as aggravated where the person promotes or facilitates the prostitution of 5 or more persons, or acts in reckless disregard of the fact that the conduct contributed to sex trafficking in violation of section 1591(a). An aggravated violation is punishable by a fine, imprisonment for not more than 25 years, or both.

Any person injured by reason of a violation of subsection (b) may recover damages and reasonable attorneys' fees in an action before any appropriate United States district court. The court must order restitution for any violation of subsection (b)(2).

It is an affirmative defense to a charge under subsection (a), or subsection (b)(1), that the defendant proves, by a preponderance of the evidence, that the promotion or facilitation of prostitution is legal in the jurisdiction where it was targeted. Public Law 115-164 added section 2421A to title 18 on April 11, 2018.

Section 230 of the Communications Act of 1934 does not impair a State criminal prosecution where the conduct underlying the charge would violate section 2421A and promotion or facilitation of prostitution is illegal in the jurisdiction where the defendant's promotion or facilitation of prostitution was targeted.

A contract or other record relating to a transaction in or affecting interstate or foreign commerce may not be denied legal effect, validity, or enforceability solely because its formation, creation, or delivery involved the action of one or more electronic agents, so long as the action of any such electronic agent is legally attributable to the person to be bound (section 7001(h)).

An electronic agent is a computer program or an electronic or other automated means used independently to initiate an action or respond to electronic records or performances in whole or in part without review or action by an individual at the time of the action or response.

Separately, a signature, contract, or other record relating to such a transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form, and a contract may not be denied effect solely because an electronic signature or electronic record was used in its formation (section 7001(a)).

Where a law requires information to be provided to a consumer in writing, an electronic record satisfies the requirement only if the consumer has affirmatively consented to its use and has not withdrawn that consent, after receiving the clear and conspicuous statement that section 7001(c)(1)(B) describes.

A State law may modify, limit, or supersede section 7001 only if it enacts the Uniform Electronic Transactions Act as approved by the National Conference of Commissioners on Uniform State Laws in 1999, or sets alternative procedures that are consistent with the Act and do not require or favor a specific technology. Section 7003 excepts records such as wills, codicils and testamentary trusts, and court orders and official court documents. The Act took effect on October 1, 2000, with a later date of March 1, 2001 for requirements that a record be retained.

A manufacturer of equipment used for advanced communications services, including end user equipment, network equipment and software, must ensure that the equipment and software it offers for sale or otherwise distributes in interstate commerce is accessible to and usable by individuals with disabilities, unless the requirement is not achievable.

A provider of advanced communications services must ensure that the services it offers in or affecting interstate commerce are accessible to and usable by individuals with disabilities, unless the requirement is not achievable.

Achievable means with reasonable effort or expense, as determined by the Commission considering the nature and cost of the steps needed, the technical and economic impact on the manufacturer or provider, the type of its operations, and the extent to which it offers accessible products and services at differing functionality and price points.

Where accessibility is not achievable by building it in or through third-party solutions available at nominal cost, the equipment or service must be compatible with existing peripheral devices or specialized customer premises equipment, unless that is not achievable.

The Commission's rules define advanced communications services as interconnected VoIP service, non-interconnected VoIP service, electronic messaging service, interoperable video conferencing service, and audio or video communications services used by inmates to communicate with individuals outside the institution.

The rules do not apply to customized equipment or services that are not offered directly to the public, or to such classes of users as to be effectively available directly to the public. Equipment and services, including interconnected VoIP service, that were subject to section 255 of the Communications Act on October 7, 2010 remain subject to that section and to parts 6 and 7 of the Commission's rules instead.

No person is liable to the extent it only carries third-party communications or provides an information location tool, such as a directory, menu, user interface or hypertext link, through which an end user reaches those services, unless it relies on third-party applications or equipment to comply. The Commission may waive the requirements for equipment or services that can access advanced communications services but are designed primarily for other purposes.

A temporary exemption for small entities expired no later than October 8, 2013. Most of the rules took effect on January 30, 2012, and beginning on October 8, 2013 products or services offered in interstate commerce had to be accessible unless not achievable. Beginning January 12, 2027, interoperable video conferencing services must provide at least one mode with captions that accurately and synchronously display the spoken communications in a video conference.

Each manufacturer and service provider must create and maintain records of its efforts to implement the accessibility requirements. An officer of each manufacturer and service provider must sign and file an annual compliance certificate with the Commission. Any person alleging a violation may file a formal or informal complaint with the Commission.

A manufacturer or service provider that violates these requirements is liable for a forfeiture of not more than $144,329 for each violation or each day of a continuing violation, and not more than $1,443,275 in total for a continuing violation arising from any single act or failure to act.

If, on or after October 8, 2013, a manufacturer of a telephone used with public mobile services includes an Internet browser in the telephone, or a provider of mobile service arranges for the inclusion of a browser in telephones to sell to customers, the manufacturer or provider must ensure that the browser's functions, including the ability to launch it, are accessible to and usable by individuals who are blind or have a visual impairment, unless doing so is not achievable.

The duty does not require a manufacturer or provider to make accessible any browser other than the one it includes or arranges to include in the telephone. It also does not require a manufacturer or provider to make Internet content, applications, or services accessible or usable, other than enabling individuals with disabilities to use an included browser to access them.

A manufacturer or provider may satisfy the requirement by ensuring the telephone or services are accessible without third-party products, or by using third-party applications or equipment available to the consumer at nominal cost that individuals with disabilities can access.

A manufacturer or service provider that violates these requirements is liable for a forfeiture of not more than $144,329 for each violation or each day of a continuing violation, and not more than $1,443,275 in total for a continuing violation arising from any single act or failure to act.

A carrier within the rule's scope must ensure that the automated airport kiosks installed on or after December 12, 2016 meet the rule's design specifications until at least 25 percent of the kiosks in each location do. By December 12, 2022, at least 25 percent of the automated kiosks a carrier owns, leases or controls in each location at a United States airport must meet the design specifications. The same two rules apply to shared-use kiosks a carrier jointly owns, leases or controls.

Where the kiosks in a location perform more than one function, the accessible kiosks must provide all the same functions as the inaccessible ones. The design specifications require every covered kiosk to provide an option for speech output. A carrier is jointly and severally liable with airport operators and other participating carriers for shared-use automated airport kiosks. A carrier must provide equivalent service on request to a passenger with a disability who cannot readily use its kiosks.

A general civil penalty of not more than $75,000 applies to violations of the Department's rules under this statute. For an individual or a small business the maximum for a violation of the statute's ban on discrimination against passengers with disabilities is $17,062. Under the statute each act of discrimination is a separate violation.

The Department of Transportation requires a carrier within the rule's scope that owns or controls a primary website that markets passenger air transportation to make the public-facing pages of that site accessible to individuals with disabilities. Only websites that market air transportation to the general public in the United States must be accessible.

Such a site's content can be viewed in English, it advertises or sells flights operating to, from, or within the United States, and it displays fares in U.S. dollars, among other characteristics. The primary website must conform to all Success Criteria and Conformance Requirements of the Web Content Accessibility Guidelines 2.0 at Level AA.

The pages for booking, check-in, itineraries, flight status, frequent flyer accounts, schedules and carrier contact information had to conform by December 12, 2015, and all remaining pages by December 12, 2016. The site had to be tested in consultation with individuals with disabilities or members of disability organizations before those dates.

A carrier may use a conforming alternate version only when conforming a public-facing page to all Level AA success criteria would constitute an undue burden or fundamentally alter the information or functionality of that page. A carrier must disclose web-based discount fares and provide web-based amenities to a passenger who says a disability keeps them from using its website and who contacts it another way.

A carrier must provide a mechanism on its primary website for persons with disabilities to request disability accommodation services for future flights, no later than December 12, 2015. By December 12, 2016, a carrier must show a disclaimer when a user follows a link from its primary website to an external website or third-party software, saying that the site or software may not follow the same accessibility policies.

A general civil penalty of not more than $75,000 applies to violations of the Department's rules under this statute. For an individual or a small business the maximum for a violation of the statute's ban on discrimination against passengers with disabilities is $17,062. Under the statute each act of discrimination is a separate violation.

A recipient of Federal financial assistance from the Department of Health and Human Services must ensure that the web content and mobile apps it provides or makes available, directly or through contractual, licensing, or other arrangements, are readily accessible to and usable by individuals with disabilities.

The standard is Level A and Level AA of the Web Content Accessibility Guidelines 2.1, unless the recipient shows that compliance would fundamentally alter a program or activity or impose undue financial and administrative burdens. Section 84.84(b) sets one compliance date for the larger recipients and a later one for the smaller recipients, by number of employees, as the criteria describe. A 2026 interim final rule moved the date for the larger recipients from May 11, 2026 to May 11, 2027.

The same rule moved the date for the smaller recipients from May 10, 2027 to May 10, 2028. Regardless of the compliance dates, recipients have an ongoing obligation to ensure that their programs and activities offered using web content and mobile apps are accessible to individuals with disabilities in accordance with their other obligations under section 504.

A recipient includes a public or private agency, institution, organization, or other entity to which Federal financial assistance is extended. The rule excepts archived web content, preexisting conventional electronic documents not currently used to apply for or take part in a program, content posted by a third party that is not posting by arrangement with the recipient, individualized password-protected or otherwise secured documents, and social media posts made before the compliance date.

A recipient may use a conforming alternate version only where it is not possible to make web content directly accessible due to technical or legal limitations. Where compliance would cause a fundamental alteration or undue burdens, the decision must be made by the head of the recipient or a designee with a written statement of reasons, and the recipient must take any other action that ensures individuals with disabilities receive the benefits or services to the maximum extent possible.

A recipient that is not in full compliance is deemed to meet the requirements where its noncompliance has so minimal an impact on access that people with disabilities can still use its web content or mobile app with substantially equivalent timeliness, privacy, independence, and ease of use. The Department has said it plans to engage in future rulemaking related to the substantive requirements of the 2024 rule.

All nonexempt full-length video programming delivered using Internet protocol must be provided with closed captions if the programming is published or exhibited on television in the United States with captions on or after the rule's dates. Video programming means programming provided by, or generally considered comparable to programming provided by, a television broadcast station, and does not include consumer-generated media.

The dates were September 30, 2012 for prerecorded programming not edited for Internet distribution, March 30, 2013 for live and near-live programming, and September 30, 2013 for prerecorded programming edited for Internet distribution. Programming already in a distributor's library before it is shown on television with captions must now be captioned within 15 days after it is shown.

Video clips of captioned television programming that a distributor or provider posts on its website or application must also be captioned, from January 1, 2016 for single excerpts, January 1, 2017 for files of several excerpts, and July 1, 2017 for clips of live and near-live programming.

A distributor or provider must enable the rendering or pass through of all required captions to the end user at the quality the owner provided, and one that provides applications, plug-ins, or devices to deliver video programming must meet the Commission's apparatus rules for them. A video programming owner must send program files to distributors and providers with captions of at least the same quality as the television captions.

A distributor or provider must make contact information available to end users for written closed captioning complaints and keep it current. A de minimis failure to comply is not a violation. The Commission may grant a full or partial exemption where captioning would be economically burdensome. If the Commission finds a violation, it may employ the full range of sanctions and remedies available under the Communications Act. The section authorizes no private right of action, and the Commission has exclusive jurisdiction over complaints.

The Department of Transportation regards as an unfair or deceptive practice a ticket agent's failure to disclose and offer web-based discount fares to prospective passengers who contact the agent through other channels, such as by telephone or at its place of business, and indicate that they are unable to use the agent's website due to a disability. The practice counts as unfair or deceptive only when a ticket agent of the kind the criteria describe commits it.

The Department's 2013 rule required those ticket agents to disclose and offer web-based fares to such passengers on or after June 10, 2014. A general civil penalty of not more than $75,000 applies to violations of the Department's rules under the statutes it enforces.

Title III of the Americans with Disabilities Act bars discrimination on the basis of disability in the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation. The Act lists the private entities that count as public accommodations when their operations affect commerce.

Title III does not apply to private clubs or establishments exempted from coverage under title II of the Civil Rights Act of 1964, or to religious organizations or entities controlled by religious organizations, including places of worship. The Department of Justice's rule names accessible electronic and information technology and screen reader software among the auxiliary aids and services a public accommodation may have to provide.

A public accommodation need not take a step that would fundamentally alter the nature of its goods or services or would result in an undue burden, meaning significant difficulty or expense. Where a particular auxiliary aid or service would cause that alteration or burden, the public accommodation must provide an alternative auxiliary aid or service, if one exists, that would not.

A public accommodation that uses an automated-attendant or interactive voice response system for incoming calls must make it provide effective real-time communication with people using auxiliary aids and services, including text telephones and relay services. A movie theater that provides captioning and audio description must say, in its notices of showings and times on websites and mobile apps, which movies or showings have them.

The Department of Justice's March 2022 guidance on web accessibility says the Department has no regulation setting out detailed standards and that its longstanding interpretation of the nondiscrimination and effective communication provisions applies to web accessibility. The guidance names the Web Content Accessibility Guidelines and the Section 508 Standards as existing technical standards that provide helpful guidance.

The guidance states that it has no legally binding effect and establishes no legally enforceable responsibilities beyond the statutes, regulations and binding judicial precedent. A person being subjected to discrimination in violation of Title III has the remedies and procedures of section 2000a-3(a) of title 42. Injunctive relief may include requiring the provision of an auxiliary aid or service, modification of a policy, or provision of alternative methods.

In a civil action by the Attorney General the court may assess a civil penalty not exceeding $50,000 for a first violation and $100,000 for any subsequent violation. A determination in a single action that the entity engaged in several discriminatory acts counts as a single violation. The court may also award monetary damages to persons aggrieved when the Attorney General requests them, and those damages do not include punitive damages.

In setting a civil penalty the court must consider any good faith effort or attempt to comply. The Department of Justice's 2025 inflation adjustment sets the first-violation maximum at $118,225 for penalties assessed after July 3, 2025. The same adjustment sets the subsequent-violation maximum at $236,451.

A covered entity must ensure that its health programs and activities provided through information and communication technology are accessible to individuals with disabilities, unless doing so would result in undue financial and administrative burdens or a fundamental alteration in the nature of the health programs or activities.

If an action would cause that alteration or those burdens, the covered entity must take any other action that would not but would nevertheless ensure that, to the maximum extent possible, individuals with disabilities receive the benefits or services of the program.

A recipient or State Exchange must also ensure that its health programs and activities provided through websites and mobile applications comply with the requirements of section 504 of the Rehabilitation Act, as interpreted consistent with title II of the ADA. A covered entity is a recipient of Federal financial assistance, the Department itself, or an entity established under title I of the Affordable Care Act.

The part applies to every health program or activity, any part of which receives Federal financial assistance, directly or indirectly, from the Department. It does not apply to an employer or other plan sponsor of a group health plan with regard to its employment practices, including the provision of employee health benefits. The regulations in the part are effective beginning July 5, 2024, unless a schedule in section 92.1 provides otherwise, and that schedule does not list section 92.204.

A 2026 notice states that a court vacated certain provisions of the 2024 rule to the extent they expand Title IX's definition of sex discrimination to include gender-identity discrimination and that the other provisions remain in force.

No qualified individual with a disability may, on the basis of disability, be excluded from participation in, be denied the benefits of, or otherwise be subjected to discrimination under any program or activity of a recipient of Federal financial assistance from the Department of Health and Human Services that is provided through kiosks.

Kiosks are self-service transaction machines that recipients make available at set physical locations for the independent use of patients or program participants in health and human service programs or activities. The 2024 rule that added the section took effect on July 8, 2024.

Subpart 39.2 of the Federal Acquisition Regulation implements section 508 of the Rehabilitation Act and the Access Board's information and communication technology accessibility standards at 36 CFR 1194.1. Unless an exception or exemption applies, acquisitions for ICT supplies and services shall meet the applicable ICT accessibility standards.

Under an indefinite-quantity contract, the contract must identify which supplies and services the contractor indicates as compliant and show where full details of compliance can be found. When acquiring commercial products and commercial services, an agency must comply with those ICT accessibility standards that can be met with supplies or services available in the commercial marketplace and that best address the agency's needs.

The requirements do not apply to ICT acquired by a contractor incidental to a contract, meaning ICT for the contractor's in-house use to perform the contract. They also do not apply to ICT operated by agencies as part of a national security system, or to operable parts and status indicators in spaces frequented only by service personnel for maintenance, repair, or occasional monitoring.

An agency may grant an exemption for undue burden, for fundamental alteration, or where no conforming commercial products and services are available, and must then give individuals with disabilities access by an alternative means. Existing ICT procured, maintained, or used on or before January 18, 2018 that complies with the earlier section 508 standard and has not been altered since need not meet the current standards.

Under the Revised 508 Standards, electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0. User interface components and the content of platforms and applications in software must conform to the same WCAG 2.0 criteria.

Requires separate verifiable parental consent for disclosing a child's personal information to third parties for targeted advertising, adds a text plus consent method, and expands recordkeeping and data retention limits. Operators had until April 22, 2026 to come into full compliance.

Requires operators of websites and online services directed to children under 13, or that have actual knowledge they collect data from a child under 13, to provide notice and obtain verifiable parental consent before collecting personal information.

Section 105(a) of title 17 provides that copyright protection under the title is not available for any work of the United States Government, but the Government may receive and hold copyrights transferred to it by assignment, bequest, or otherwise. Under section 105(b), the covered author of a covered work owns the copyright to it. A covered author is a civilian member of the faculty of a covered institution.

A covered work is a literary work produced by a covered author in the course of employment at a covered institution for publication by a scholarly press or journal. Under section 302(a), copyright in a work created on or after January 1, 1978 subsists from its creation and endures for the life of the author and 70 years after the author's death.

Section 302(b) gives a joint work prepared by two or more authors who did not work for hire a term of the life of the last surviving author and 70 years after that author's death. Under section 302(c), an anonymous work, a pseudonymous work, or a work made for hire endures for 95 years from the year of its first publication or 120 years from the year of its creation, whichever expires first.

Section 511(a) provides that a State, a State instrumentality, and a State officer or employee acting in an official capacity are not immune, under the Eleventh Amendment or any other doctrine of sovereign immunity, from suit in Federal court by any person for a violation of the exclusive rights of a copyright owner provided by sections 106 through 122.

In Allen v. Cooper the Supreme Court held that Congress lacked authority to abrogate the States' immunity from copyright infringement suits in the Copyright Remedy Clarification Act of 1990.

Section 106 of title 17 gives the owner of copyright the exclusive rights to do and to authorize six kinds of act, subject to sections 107 through 122. The first three rights are to reproduce the work in copies or phonorecords, to prepare derivative works based upon it, and to distribute copies or phonorecords of it to the public by sale or other transfer of ownership, or by rental, lease, or lending.

Clauses (4) and (5) add the rights to perform and to display the work publicly, for the kinds of work they name. Clause (6) adds, for sound recordings, the right to perform the work publicly by means of a digital audio transmission.

Section 101 provides that to perform or display a work publicly includes transmitting or otherwise communicating a performance or display of it to the public by means of any device or process, whether the members of the public receive it in the same place or in separate places and at the same time or at different times.

Section 101 defines a work as fixed in a tangible medium of expression when its embodiment in a copy or phonorecord, by or under the authority of the author, is sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of more than transitory duration.

Section 101 defines a derivative work as a work based upon one or more preexisting works, such as a translation, musical arrangement, dramatization, fictionalization, motion picture version, sound recording, art reproduction, abridgment, condensation, or any other form in which a work may be recast, transformed, or adapted.

Section 501(a) makes anyone who violates any of the exclusive rights of the copyright owner provided by sections 106 through 122, or who imports copies or phonorecords into the United States in violation of section 602, an infringer. The word anyone in section 501(a) includes any State, any instrumentality of a State, and any officer or employee of a State or instrumentality of a State acting in an official capacity.

Under section 501(b), the legal or beneficial owner of an exclusive right is entitled, subject to the requirements of section 411, to institute an action for any infringement of that right committed while he or she is the owner of it. The House report on the 1976 Act says that the phrase to authorize in section 106 is intended to avoid any questions as to the liability of contributory infringers.

In MGM Studios v. Grokster the Supreme Court said that the Copyright Act does not expressly render anyone liable for infringement committed by another, and that the doctrines of secondary liability emerged from common law principles. The Court described contributory infringement as intentionally inducing or encouraging direct infringement. The Court described vicarious infringement as profiting from direct infringement while declining to exercise a right to stop or limit it.

Section 109(a) entitles the owner of a particular copy or phonorecord lawfully made under title 17, or any person authorized by that owner, to sell or otherwise dispose of the possession of that copy or phonorecord without the authority of the copyright owner. Section 109(d) withholds that privilege, unless the copyright owner authorizes it, from a person who has acquired possession of the copy from the copyright owner by rental, lease, loan, or otherwise without acquiring ownership of it.

Section 109(b)(1)(A) bars any person in possession of a particular copy of a computer program from disposing of its possession, for the purposes of direct or indirect commercial advantage, by rental, lease, or lending, or by any other act or practice in the nature of rental, lease, or lending, unless the owner of copyright in the program authorizes it.

Section 109(b)(1)(B) excludes a computer program embodied in a machine or product that cannot be copied during the ordinary operation or use of the machine or product, and a computer program embodied in or used in conjunction with a limited purpose computer designed for playing video games.

Section 109(b)(2)(A) provides that the limit does not apply to the lending of a computer program for nonprofit purposes by a nonprofit library, if each lent copy has affixed to its packaging a warning of copyright in accordance with requirements the Register of Copyrights prescribes by regulation.

Section 109(b)(4) makes a person who distributes a copy of a computer program in violation of paragraph (1) an infringer of copyright under section 501, subject to the remedies in sections 502 through 505, and provides that the violation is not a criminal offense under section 506. Section 117(a) makes it not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that program, provided one of two conditions is met.

The first condition is that the new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and is used in no other manner. The second condition is that the new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.

Under section 117(b), exact copies prepared under the section may be leased, sold, or otherwise transferred, along with the copy from which they were prepared, only as part of the lease, sale, or other transfer of all rights in the program, and adaptations so prepared may be transferred only with the authorization of the copyright owner.

Section 117(c) makes it not an infringement for the owner or lessee of a machine to make or authorize the making of a copy of a computer program, made solely by virtue of the activation of a machine that lawfully contains an authorized copy, for purposes only of maintenance or repair of that machine.

That copy must be used in no other manner and destroyed immediately after the maintenance or repair is completed, and any part of the program not necessary for the machine to be activated must not be accessed or used other than to make the copy. Paragraph (1) of section 109(b), which covers computer programs, was added in 1990. Section 117 was substituted in its present form in 1980. Subsections (c) and (d) of section 117 were added in 1998.

Section 102(a) provides that copyright protection subsists in original works of authorship fixed in any tangible medium of expression, now known or later developed, from which they can be perceived, reproduced, or otherwise communicated, either directly or with the aid of a machine or device. Works of authorship include eight listed categories, the first of which is literary works.

Section 101 defines a computer program as a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result. Section 101 defines literary works as works, other than audiovisual works, expressed in words, numbers, or other verbal or numerical symbols or indicia, regardless of the nature of the material objects in which they are embodied.

Section 102(b) provides that in no case does copyright protection for an original work of authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work.

The House report says that section 102(b) is intended, among other things, to make clear that the expression adopted by the programmer is the copyrightable element in a computer program, and that the actual processes or methods embodied in the program are not within the scope of the copyright law. The House report also treats computer programs as among the new forms of expression that could be regarded as an extension of copyrightable subject matter Congress had already intended to protect.

Section 305e of title 25, part of the Indian Arts and Crafts Act, lets a civil action be brought against a person who, directly or indirectly, offers or displays for sale or sells a good, with or without a Government trademark, in a manner that falsely suggests it is Indian produced, an Indian product, or the product of a particular Indian or Indian tribe or Indian arts and crafts organization, resident within the United States.

For this section, an Indian is an individual who is a member of an Indian tribe or is certified as an Indian artisan by an Indian tribe. The action may be initiated by the Attorney General at the request of the Secretary of the Interior acting for an Indian tribe, an Indian, or an Indian arts and crafts organization, by an Indian tribe acting for itself, a member, or an organization, by an Indian, or by an Indian arts and crafts organization.

The plaintiff may obtain injunctive or other equitable relief and recover the greater of treble damages or, for each aggrieved individual Indian, Indian tribe, or Indian arts and crafts organization, not less than $1,000 for each day on which the offer or display for sale or sale continues. Damages for the treble measure include any and all gross profits the defendant accrued from the activities found to violate the section.

The court may also award punitive damages and the costs of the civil action and a reasonable attorney's fee. An amount recovered is paid to the Indian tribe, the Indian, or the Indian arts and crafts organization on whose behalf the civil action was initiated, subject to the deductions the section allows.

Section 2(a) of the Trademark Act of 1946 (the Lanham Act), codified at section 1052(a) of title 15, is a ground for refusing registration on the principal register to a mark that consists of or comprises matter which may falsely suggest a connection with persons, living or dead, institutions, beliefs, or national symbols. The provision is a bar on registration, not a prohibition on use: it does not itself prohibit anyone from using a name, logo, or word.

The same paragraph also lists immoral, deceptive, or scandalous matter, matter which may disparage, and a geographical indication for wines or spirits that identifies a place other than the origin of the goods. For the constitutionality of certain provisions of the section, the Code refers readers to the Table of Laws Held Unconstitutional in Whole or in Part by the Supreme Court.

In examining trademark applications, the USPTO determines whether a mark falsely suggests a connection to the tribal insignia of the Native American tribes whose insignia are entered in its database. An insignia is entered only if the tribe is recognized federally or by its state and the insignia, adopted by tribal resolution, is a flag, coat of arms, other emblem, or device, so a word alone is not entered.

Entry in the database does not grant the tribe any rights and is not the legal equivalent of registering the insignia as a trademark.

Section 301 preempts all state law rights that are equivalent to the exclusive rights under the Copyright Act in works fixed in a tangible medium. Under Barclays Capital, most state hot-news misappropriation claims are preempted unless they contain genuine 'extra elements' beyond the act of copying and redistributing protected expression. There is no US federal press-publisher neighbouring right.

The EU-style ancillary copyright (Article 15 Digital Single Market (DSM) Directive) has no counterpart in US federal law, and § 301 blocks states from creating functional equivalents.

The federal fair-use statute is the primary framework for evaluating whether news aggregators, search engines, and AI training pipelines may reproduce copyrighted content without a license. Courts weigh four factors: purpose and character of the use (especially transformativeness), nature of the copyrighted work, amount and substantiality taken, and effect on the market for the original.

Commercial, non-transformative snippet aggregation that substitutes for licensed feeds fails fair use (Meltwater); transformative indexing and limited display may succeed (Google Books, Perfect 10).