Protecting the security and privacy of users

(a) In general (1) No violation Subject to section (b), a covered company shall not be in violation of section 3 for an action that is— (A) necessary to achieve user privacy or security; (B) taken to prevent spam or fraud; (C) necessary to prevent unlawful infringement of preexisting intellectual property; or (D) taken to prevent a violation of, or comply with, Federal or State law. (2) Privacy and security protections In paragraph (1), the term necessary to achieve user privacy or security includes— (A) allowing an end user to opt in, and providing information regarding the reasonable risks, prior to enabling installation of the third-party apps or app stores; (B) removing malicious or fraudulent apps or app stores from an end user device; (C) providing an end user with the means to verify the authenticity and origin of third-party apps or app stores; and (D) providing an end user with the option to limit access to the user's device or device features, or limit the collection and sharing of the data of the user with third-party apps or app stores. (b) Requirements (1) In general Subsection (a) shall only apply if the covered company establishes by a preponderance of the evidence that the action described in that subsection is— (A) applied on a demonstrably consistent basis to— (i) apps of the covered company or its business partners; and (ii) other apps; and (B) narrowly tailored and could not be achieved through a less discriminatory and technically possible means. (2) Certification The principal executive officer or officers of the covered company, or persons performing similar functions shall submit to the court a certification made under penalty of perjury in accordance with section 1746 of title 28, United States Code, that the action described in subsection (a) is not used as a pretext to exclude, or impose unnecessary or discriminatory terms on, third-party apps, in-app payment systems, or alternative app stores.