Stopping Grinch Bots Act of 2025

This bill prohibits people from bypassing security measures or access controls on online retail websites that are used to enforce purchase limits or manage inventory. It also bans selling products obtained through such circumvention. The Federal Trade Commission (FTC) will enforce this as an unfair or deceptive practice, and state attorneys general can also bring civil actions to stop violations, seek compliance, and obtain damages for residents.

Sec. 2, Unfair or deceptive acts or practices relating to circumvention of online access control measures: It is unlawful to circumvent a security measure or access control on a website that enforces posted purchasing limits or manages inventory, or to sell products obtained through such circumvention if the seller participated in or knew about the violation. An exception allows creating or using software to investigate violations or conduct security research to advance computer security knowledge or develop security products.

Sec. 2(b), Enforcement by the Federal Trade Commission: A violation is treated as an unfair or deceptive act under the FTC Act. The FTC enforces this with the same powers and penalties as the FTC Act, and nothing limits the FTC's authority under other laws.

Sec. 2(c), Enforcement by States: A state attorney general can bring a civil action in federal court to enjoin violations, compel compliance, and obtain damages for state residents. They must notify the FTC 10 days before suing, unless not feasible. The FTC can intervene. If the FTC brings its own action, the state cannot sue the same defendant for the same violation during that action. Other state consumer protection officers can also bring actions, and states can still pursue their own state law claims.

Sec. 2(d), Definitions: "Commission" means the FTC. "Posted" means clearly and conspicuously published on an internet website or online service.