A bill to establish a regulatory framework for the comprehensive protection of personal data for individuals under the aegis of the Federal Trade Commission, to amend the Children's Online Privacy Protection Act of 1998 to improve provisions relating to collection, use, and disclosure of personal information of children, and for other purposes.

TITLE I--COMMERCIAL PRIVACY

Commercial Privacy Bill of Rights Act of 2015

Directs the Federal Trade Commission (FTC) to initiate a rulemaking to require covered entities that collect or use information about individuals to carry out security measures to protect personally identifiable information, unique identifier information, and other information that may be used to identify a specific individual.

Defines "covered entity" as a person (a person, partnership, or corporation over which the FTC has authority under the Federal Trade Commission Act, a common carrier subject to the Communications Act of 1934, or a nonprofit organization) who collects, uses, transfers, or stores such information concerning more than 5,000 individuals during any consecutive 12-month period.

Directs the FTC to require covered entities to: (1) notify individuals of their practices regarding the collection, use, transfer, and storage of such information; (2) provide timely notice before implementing a material change in such practices; (3) offer individuals a mechanism to provide opt-in consent for any unauthorized use of such information or a third party's use for behavioral advertising or marketing; and (4) provide access to, and methods to correct, stored information.

Permits covered entities to execute contracts with service providers to collect, use, and store information on behalf of the covered entity.

Restricts covered entities to the collection of only as much information relating to an individual as reasonably necessary to: (1) process or enforce a transaction or deliver a requested service, including inventory management, financial reporting and accounting, planning, product or service improvement, forecasting, and customer support; (2) prevent or detect fraud or provide for a secure environment; (3) investigate a possible crime or comply with a law; (4) market or advertise to such individual if the information used for such marketing or advertising was collected directly by the covered entity; and (5) conduct internal operations and customer research, including the collection of information about Internet website visits and click-through rates to improve website navigation and the customer's experience.

Limits the duration of time that a covered entity is authorized to retain such information to only the period necessary to provide the transaction, deliver the service, or comply with a law. Restricts the use of retained information to the purpose for which it was collected or a reasonably related purpose.