n of copyright owners against the unauthorized access to
their encrypted copyrighted works.

The report shall include legislative recommendations, if any.

(h) Exceptions Regarding Minors. In applying subsection (a) to a
component or part, the court may consider the necessity for its intended
and actual incorporation in a technology, product, service, or device,
which-

(1) does not itself violate the provisions of this title; and

(2) has the sole purpose to prevent the access of minors to material on
the Internet.

(i) Protection of Personally Identifying Information.

(1) Circumvention Permitted. Notwithstanding the provisions of
subsection (a)(1)(A), it is not a violation of that subsection for a
person to circumvent a technological measure that effectively controls
access to a work protected under this title, if-

(A) the technological measure, or the work it protects, contains the
capability of collecting or disseminating personally identifying
information reflecting the online activities of a natural person who
seeks to gain access to the work protected;

(B) in the normal course of its operation, the technological measure, or
the work it protects, collects or disseminates personally identifying
information about the person who seeks to gain access to the work
protected, without providing conspicuous notice of such collection or
dissemination to such person, and without providing such person with the
capability to prevent or restrict such collection or dissemination;

(C) the act of circumvention has the sole effect of identifying and
disabling the capability described in subparagraph (A), and has no other
effect on the ability of any person to gain access to any work; and

(D) the act of circumvention is carried out solely for the purpose of
preventing the collection or dissemination of personally identifying
information about a natural person who seeks to gain access to the work
protected, and is not in violation of any other law.

(2) Inapplicability to Certain Technological Measures.

This subsection does not apply to a technological measure, or a work it
protects, that does not collect or disseminate personally identifying
information and that is disclosed to a user as not having or using such
capability.

(j) Security Testing.

(1) Definition. For purposes of this subsection, the term "security
testing" means accessing a computer, computer system, or computer
network, solely for the purp