Pennsylvania Consumer Protection Against Computer Spyware Act
73 P.S. § 2330.1 - § 2330.20
Title 73 P.S. Trade and Commerce
Chapter 43A. Consumer Protection Against Computer Spyware Act
§ 2330.1. Short Title
§ 2330.2. Definitions
§ 2330.3. Computer Spyware Prohibitions
§ 2330.4. Control or Modification
§ 2330.5. Misrepresentation and Deception
§ 2330.6. Nonapplicability
§ 2330.7. Criminal Enforcement
§ 2330.8. Penalty
§ 2330.9. Civil Relief
§ 2330.10. Reserved
§ 2330.11. Reserved
§ 2330.12. Reserved
§ 2330.13. Reserved
§ 2330.14. Reserved
§ 2330.15. Reserved
§ 2330.16. Reserved
§ 2330.17. Reserved
§ 2330.18. Reserved
§ 2330.19. Construction
§ 2330.20. Effective Date
§ 2330.1. Short title
This act shall be known and may be cited as the Consumer Protection Against Computer Spyware Act.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 1, effective in 60 days [Dec. 27, 2010].
73 P.S. § 2330.1, PA ST 73 P.S. § 2330.1
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.1
§ 2330.2. Definitions
The following words and phrases when used in this act shall have the meanings given to them in this section unless the context clearly indicates otherwise:
“Authorized user.” With respect to a computer, a person who owns or is authorized by the owner or lessee to use the computer.
“Cause to be copied.” To distribute, transfer or procure the copying of computer software or any component thereof. The term shall not include the following:
(1) Transmission, routing, provision of intermediate temporary storage or caching of software.
(2) A storage or hosting medium, such as a compact disc, Internet website or computer server, through which the software was distributed by a third party.
(3) An information location tool, such as a directory, index, reference, pointer or hypertext link, through which the user of the computer located the software.
“Communications provider.” Entity providing communications networks or services that enable consumers to access the Internet or destinations on the public switched telephone network via a computer modem. This term shall include cable service providers that also provide telephone services and providers of Voice over Internet Protocol services.
“Computer software.” A sequence of instructions written in any programming language that is executed on a computer. The term shall not include a text or data file, an Internet website or a data component of an Internet website that is not executable independently of the Internet website.
“Computer virus.” A computer program or other set of instructions that is designed to degrade the performance of or disable a computer, computer network or computer software and is designed to have the ability to replicate itself on other computers or computer networks without the authorization of the owners of those computers or computer networks.
“Damage.” Any material impairment to the integrity, functionality or availability of data, software, a computer, a system or information.
“Deceptive” or “deception.” Includes, but is not limited to:
(1) An intentionally and materially false or fraudulent statement.
(2) A statement or description that intentionally omits or misrepresents material information in order to deceive the authorized user.
(3) An intentional and material failure to provide any notice to an authorized user regarding the download or installation of software in order to deceive the authorized user.
“Execute.” With respect to computer software, the performance of the functions or the carrying out of the instructions of the computer software.
“Internet.” The global information system that is logically linked together by a globally unique address space based on the Internet Protocol (IP), or its subsequent extensions, and that is able to support communications using the Transmission Control Protocol/Internet Protocol (TCP/IP) suite, or its subsequent extensions, or other IP-compatible protocols, and that provides, uses or makes accessible, either publicly or privately, high-level services layered on the communications and related infrastructure described in this act.
“Message.” A graphical or text communication presented to an authorized user of a computer other than communications originated and sent by the computer's operating system or communications presented for any of the purposes described in section 6.1
“Person.” Any individual, partnership, corporation, limited liability company or other organization, or any combination thereof.
“Personally identifiable information.” The term shall include any of the following:
(1) First name or first initial in combination with last name.
(2) Credit or debit card numbers or other financial account numbers.
(3) A password or personal identification number required to access an identified financial account other than a password, personal identification number or other identification number transmitted by an authorized user to the issuer of the account or its agent.
(4) Social Security number.
(5) Any of the following information in a form that personally identifies an authorized user:
(i) Account balances.
(ii) Overdraft history.
(iii) Payment history.
(iv) A history of Internet websites visited.
(v) Home address.
(vi) Work address.
(vii) A record of a purchase or purchases.
“Procure the copying.” To pay, provide other consideration to or induce another person to cause software to be copied onto a computer.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 2, effective in 60 days [Dec. 27, 2010].
Footnotes
1
73 P.S. § 2330.6.
73 P.S. § 2330.2, PA ST 73 P.S. § 2330.2
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.2
§ 2330.3. Computer spyware prohibitions
A person or entity that is not an authorized user shall not, with actual knowledge, with conscious avoidance of actual knowledge or willfully, cause computer software to be copied or procure the copying onto the computer of an authorized user in this Commonwealth and use the software to do any of the following acts or any other acts deemed to be deceptive:
(1) Modify through deceptive means any of the following settings related to the computer's access to or use of the Internet:
(i) The page that appears when an authorized user launches an Internet browser or similar software program used to access and navigate the Internet.
(ii) The default provider or Internet website proxy the authorized user uses to access or search the Internet.
(iii) The authorized user's list of bookmarks used to access Internet website pages.
(2) Collect through deceptive means personally identifiable information that meets any of the following criteria:
(i) It is collected through the use of a keystroke-logging function that records all keystrokes made by an authorized user who uses the computer and transfers that information from the computer to another person.
(ii) It includes all or substantially all of the Internet websites visited by an authorized user, other than Internet websites of the provider of the software, if the computer software was installed in a manner designed to conceal from all authorized users of the computer the fact that the software is being installed.
(iii) It is a data element described in paragraph (2), (3), (4) or (5)(i) or (ii) of the definition of “personally identifiable information” that is extracted from the authorized user's computer hard drive for a purpose wholly unrelated to any of the purposes of the software or service described to an authorized user.
(3) Prevent, without the authorization of an authorized user, through deceptive means an authorized user's reasonable efforts to block the installation of or to disable software by causing software that the authorized user has properly removed or disabled to automatically reinstall or reactivate on the computer without the authorization of an authorized user.
(4) Misrepresent that software will be uninstalled or disabled by an authorized user's action with knowledge that the software will not be so uninstalled or disabled.
(5) Through deceptive means, remove, disable or render inoperative security, antispyware or antivirus software installed on the computer.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 3, effective in 60 days [Dec. 27, 2010].
73 P.S. § 2330.3, PA ST 73 P.S. § 2330.3
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.3
§ 2330.4. Control or modification
A person or entity that is not an authorized user shall not, with actual knowledge, with conscious avoidance of actual knowledge or willfully, cause computer software to be copied or procure the copying onto the computer of an authorized user in this Commonwealth and use the software to do any of the following acts or any other acts deemed to be deceptive:
(1) Take control of the authorized user's computer by doing any of the following:
(i) Transmitting or relaying commercial electronic mail or a computer virus from the authorized user's computer where the transmission or relaying is initiated by a person other than the authorized user and without the authorization of an authorized user.
(ii) Accessing or using the authorized user's modem or Internet service for the purpose of causing damage to the authorized user's computer or of causing an authorized user to incur financial charges for a service that is not authorized by an authorized user.
(iii) Using the authorized user's computer as part of an activity performed by a group of computers for the purpose of causing damage to another computer, including, but not limited to, launching a denial of service attack.
(iv) Opening a series of stand-alone messages in the authorized user's computer without the authorization of an authorized user and with knowledge that a reasonable computer user cannot close the advertisements without turning off the computer or closing the Internet application.
(2) Modify any of the following settings related to the computer's access to or use of the Internet:
(i) An authorized user's security or other settings that protect information about the authorized user for the purpose of stealing personal information of an authorized user.
(ii) The security settings of the computer for the purpose of causing damage to one or more computers.
(3) Prevent, without the authorization of an authorized user, an authorized user's reasonable efforts to block the installation of or to disable software by doing any of the following:
(i) Presenting the authorized user with an option to decline installation of software with knowledge that, when the option is selected by the authorized user, the installation nevertheless proceeds.
(ii) Falsely representing that software has been disabled.
(iii) Requiring, in a deceptive manner, the user to access the Internet to remove the software with knowledge or reckless disregard of the fact that the software frequently operates in a manner that prevents the user from accessing the Internet.
(iv) Changing the name, location or other designation information of the software for the purpose of preventing an authorized user from locating the software to remove it.
(v) Using randomized or deceptive file names, directory folders, formats or registry entries for the purpose of avoiding detection and removal of the software by an authorized user.
(vi) Causing the installation of software in a particular computer directory or computer memory for the purpose of evading authorized users' attempts to remove the software from the computer.
(vii) Requiring, without the authority of the owner of the computer, that an authorized user obtain a special code or download software from a third party to uninstall the software.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 4, effective in 60 days [Dec. 27, 2010].
73 P.S. § 2330.4, PA ST 73 P.S. § 2330.4
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.4
§ 2330.5. Misrepresentation and deception
A person or entity who is not an authorized user shall not do any of the following or any other misrepresenting and deceptive acts with regard to the computer of an authorized user in this Commonwealth:
(1) Induce an authorized user to install a software component onto the computer by misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content.
(2) Causing the copying and execution on the computer of a computer software component with the intent of causing an authorized user to use the component in a way that violates any other provision of this section.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 5, effective in 60 days [Dec. 27, 2010].
73 P.S. § 2330.5, PA ST 73 P.S. § 2330.5
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.5
§ 2330.6. Nonapplicability
(1) Nothing in section 4 or 51 shall apply to any monitoring of or interaction with a user's Internet or other network connection or service, or a protected computer, by a cable operator, computer hardware or software provider or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, repair, authorized updates of software or system firmware, network management or maintenance, authorized remote system management or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service or computer software, including scanning for and removing software proscribed under this act.
(2) Nothing in this act shall limit the rights of providers of wire and electronic communications under 18 U.S.C. § 2511 (relating to interception and disclosure of wire, oral, or electronic communications prohibited).
Credits
2010, Oct. 27, P.L. 855, No. 86, § 6, effective in 60 days [Dec. 27, 2010].
Effective: December 27, 2010
73 P.S. § 2330.6
§ 2330.7. Criminal enforcement
(a) District attorneys.--The district attorneys of the several counties shall have authority to investigate and to institute criminal proceedings for any violations of this act.
(b) Attorney General.--In addition to the authority conferred upon the Attorney General under the act of October 15, 1980 (P.L. 950, No. 164),1 known as the Commonwealth Attorneys Act, the Attorney General shall have the authority to investigate and institute criminal proceedings for any violation of this act. A person charged with a violation of this act by the Attorney General shall not have standing to challenge the authority of the Attorney General to investigate or prosecute the case and, if any such challenge is made, the challenge shall be dismissed, and no relief shall be available in the courts of this Commonwealth to the person making the challenge.
(c) Proceedings against persons outside Commonwealth.--In addition to powers conferred upon district attorneys and the Attorney General in subsections (a) and (b), district attorneys and the Attorney General shall have the authority to investigate and initiate criminal proceedings against persons for violations of this act in accordance with 18 Pa.C.S. § 102 (relating to territorial applicability).
Credits
2010, Oct. 27, P.L. 855, No. 86, § 7, effective in 60 days [Dec. 27, 2010].
Footnotes
1
71 P.S. § 732-101 et seq.
73 P.S. § 2330.7, PA ST 73 P.S. § 2330.7
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.7
§ 2330.8. Penalty
Any person that violates the provisions of sections 3(2) and 4(1)(i), (ii) and (iii) and (2)1 commits a felony of the second degree and shall, upon conviction, be sentenced to imprisonment for not more than ten years or to pay a fine, notwithstanding 18 Pa.C.S. § 1101 (relating to fines), of not more than $25,000, or both.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 8, effective in 60 days [Dec. 27, 2010].
Footnotes
1
73 P.S. §§ 2330.3, 2330.4.
73 P.S. § 2330.8, PA ST 73 P.S. § 2330.8
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.8
§ 2330.10. Reserved
§ 2330.11. Reserved
§ 2330.12. Reserved
§ 2330.13. Reserved
§ 2330.14. Reserved
§ 2330.15. Reserved
§ 2330.16. Reserved
§ 2330.17. Reserved
§ 2330.18. Reserved
§ 2330.19. Construction
The provisions of this act shall not limit the jurisdiction and authority of the Office of Attorney General, including, but not limited to, the jurisdiction and authority granted pursuant to the act of October 15, 1980 (P.L. 950, No. 164),1 known as the Commonwealth Attorneys Act, and the act of December 17, 1968 (P.L. 1224, No. 387),2 known as the Unfair Trade Practices and Consumer Protection Law.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 19, effective in 60 days [Dec. 27, 2010].
Footnotes
1
71 P.S. § 732-101 et seq.
2
73 P.S. § 201-1 et seq.
73 P.S. § 2330.19, PA ST 73 P.S. § 2330.19
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.19
§ 2330.20. Effective date
This act shall take effect in 60 days.
Credits
2010, Oct. 27, P.L. 855, No. 86, § 20, effective in 60 days [Dec. 27, 2010].
73 P.S. § 2330.20, PA ST 73 P.S. § 2330.20
Current through 2022 Regular Session Act 20. Some statute sections may be more current, see credits for details.
Effective: December 27, 2010
73 P.S. § 2330.20
For more information, see here: https://govt.westlaw.com/pac/Browse/Home/Pennsylvania/UnofficialPurdonsPennsylvaniaStatutes?guid=N537BC7C0183111E089A4A7FFFD303CEB&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default)
These materials were obtained directly from the State Legislative websites and are posted here for your review and reference only. No Claim to Original State Government Works. This may not be the most recent version. The State may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.