APP Act

II 117TH CONGRESS 1ST SESSION S. 47 To require software marketplace operators and owners of covered foreign software to provide consumers with a warning prior to the download of such software, to establish consumer data protections, and for other purposes. IN THE SENATE OF THE UNITED STATES JANUARY 26, 2021 Mr. RUBIO introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require software marketplace operators and owners of covered foreign software to provide consumers with a warning prior to the download of such software, to estab- lish consumer data protections, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Adversarial Platform 4 Prevention Act of 2021’’ or the ‘‘APP Act’’. 5 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 2 •S 47 IS SEC. 2. CONSUMER PROTECTIONS REGARDING COVERED 1 FOREIGN SOFTWARE. 2 (a) CONSUMER WARNING AND ACKNOWLEDGMENT 3 FOR DOWNLOAD OF COVERED FOREIGN SOFTWARE.— 4 (1) IN GENERAL.—A software marketplace op- 5 erator or an owner of covered foreign software may 6 not: 7 (A) Permit a consumer to download cov- 8 ered foreign software unless, before the 9 download begins— 10 (i) a warning that meets the require- 11 ments of paragraph (2) is displayed to the 12 consumer, separately from any privacy pol- 13 icy, terms of service, or other notice; and 14 (ii) the consumer is required to choose 15 (by taking an affirmative step such as 16 clicking on a button) between the options 17 of— 18 (I) acknowledging such warning 19 and proceeding with the download; or 20 (II) cancelling the download. 21 (B) Make available covered foreign soft- 22 ware for download by consumers unless the op- 23 erator or owner has in place procedures to en- 24 sure compliance with subparagraph (A). 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 3 •S 47 IS (2) REQUIREMENTS FOR WARNING.—The re- 1 quirements of this paragraph are, with respect to a 2 warning regarding covered foreign software— 3 (A) that the warning include— 4 (i) the name of the covered foreign 5 software; 6 (ii) the name of each owner of the 7 covered foreign software, and, if applicable 8 with respect to each such owner, the name 9 of the covered country— 10 (I) under the laws of which such 11 owner is organized; 12 (II) in which such owner con- 13 ducts its principal operations; or 14 (III) in which such owner is 15 headquartered; 16 (iii) the name of each controlling enti- 17 ty of the owner of the covered foreign soft- 18 ware, and if applicable with respect to each 19 such controlling entity, the name of the 20 covered country— 21 (I) under the laws of which such 22 entity is organized; 23 (II) in which such entity con- 24 ducts its principal operations; or 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 4 •S 47 IS (III) in which such entity is 1 headquartered; 2 (iv) any enumerated risk to data pri- 3 vacy and security or the censorship of 4 speech associated with the laws and prac- 5 tices of a covered country disclosed under 6 this subparagraph; 7 (v) whether the owner of a covered 8 foreign software, or any controlling entity 9 of such owner, has ever provided the data 10 of United States consumers, as it relates to 11 such software, to any law enforcement 12 agency, intelligence agency, or other gov- 13 ernment entity of a covered country; and 14 (vi) a description of how to acknowl- 15 edge the warning and either proceed with 16 or cancel the download; 17 (B) that the warning be updated annually; 18 and 19 (C) such other requirements as the Com- 20 mission, in consultation with the Attorney Gen- 21 eral of the United States, shall determine. 22 (3) LIABILITY OF SOFTWARE OWNER.—If a 23 software marketplace operator permits a consumer 24 to download covered foreign software or makes cov- 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 5 •S 47 IS ered foreign software available for download in viola- 1 tion of paragraph (1), the operator shall not be lia- 2 ble for a violation of such paragraph if the operator 3 reasonably relied on inaccurate information from the 4 owner of the covered foreign software in determining 5 that the software was not covered foreign software, 6 and the owner of the covered foreign software shall 7 be considered to have committed the violation of 8 such paragraph. 9 (b) CONSUMER DATA PROTECTIONS.— 10 (1) CONSUMER DATA PRIVACY PRACTICES.— 11 (A) CONSUMER DATA REPORT.—Not later 12 than 30 days after the date of enactment of 13 this Act (or in the case of covered foreign soft- 14 ware that is created after such date or software 15 that becomes covered foreign software after 16 such date, 60 days after the date that such 17 software is created or becomes covered foreign 18 software), and annually thereafter, an owner of 19 covered foreign software shall submit to the 20 Commission and the Attorney General of the 21 United States a report that includes a complete 22 description of any consumer data privacy prac- 23 tice of the owner as it relates to the data of 24 United States consumers, including— 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 6 •S 47 IS (i) the type of data of United States 1 consumers being accessed; 2 (ii) a description of how such data is 3 used by the owner; 4 (iii) a description of any consumer 5 data protection measure in place that pro- 6 tects the rights and interests of United 7 States consumers; 8 (iv) information regarding— 9 (I) the number of requests from 10 a law enforcement agency, intelligence 11 agency, or other government entity of 12 a covered country to disclose the con- 13 sumer data of a person in the United 14 States; and 15 (II) a description of how such re- 16 quests were handled; and 17 (v) a description of any internal con- 18 tent moderation practice of the owner as it 19 relates to the data of consumers in the 20 United States, including any such practice 21 that also relates to consumers in another 22 country. 23 (B) PUBLIC ACCESSIBILITY.—Notwith- 24 standing any other provision of law, not later 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 7 •S 47 IS than 60 days after the receipt of a report under 1 subparagraph (A), the Attorney General of the 2 United States shall publish the information con- 3 tained in such report (except for any confiden- 4 tial material) in a publicly accessible manner. 5 (2) CONSUMER DATA DISCLOSURE PRAC- 6 TICES.— 7 (A) EFFECT OF DISCLOSURE AND CENSOR- 8 SHIP.—An owner of covered foreign software 9 may not collect or store data of United States 10 consumers, as it relates to such covered foreign 11 software, if such owner complies with any re- 12 quest from a law enforcement agency, intel- 13 ligence agency, or other government entity of a 14 covered country— 15 (i) to disclose the consumer data of a 16 person in the United States; or 17 (ii) to censor the online activity of a 18 person in the United States. 19 (B) REPORT TO FEDERAL TRADE COMMIS- 20 SION AND ATTORNEY GENERAL OF THE UNITED 21 STATES.—Not later than 14 days after receiv- 22 ing a request described in subparagraph (A), an 23 owner of covered foreign software shall submit 24 to the Commission and the Attorney General of 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 8 •S 47 IS the United States a report that includes a de- 1 scription of such request. 2 (C) ACCESS TO CONSUMER DATA IN SUB- 3 SIDIARIES.—Not later than 1 year after the 4 date of enactment of this Act, the Commission, 5 in consultation with the Attorney General of the 6 United States, shall issue regulations to require 7 an owner of covered foreign software to imple- 8 ment consumer data protection measures to en- 9 sure that any parent company in a covered 10 country may not access the consumer data col- 11 lected and stored, or otherwise held, by a sub- 12 sidiary entity of such parent company in a 13 country that is not a covered country. 14 (3) PROHIBITIONS ON STORAGE, USE, AND 15 SHARING OF CONSUMER DATA.— 16 (A) USE, TRANSFER, AND STORAGE OF 17 CONSUMER DATA.—With respect to the con- 18 sumer data of any person in the United States, 19 an owner of covered foreign software may not— 20 (i) use such data in a covered country; 21 (ii) transfer such data to a covered 22 country; or 23 (iii) store such data outside of the 24 United States. 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 9 •S 47 IS (B) SHARING OF CONSUMER DATA.—An 1 owner of covered foreign software may not 2 share with, sell to, or otherwise disclose to any 3 other commercial entity the consumer data of 4 any person in the United States. 5 (4) CENSORSHIP REMEDY.—In the case where 6 an owner of covered foreign software censors the on- 7 line activity of a person in the United States, such 8 owner shall provide any affected user with a means 9 to appeal such censorship. 10 (c) NONAPPLICATION OF COMMUNICATIONS DE- 11 CENCY ACT PROTECTIONS.—Notwithstanding section 230 12 of the Communications Act of 1934 (47 U.S.C. 230) (com- 13 monly known as the ‘‘Communications Decency Act’’), an 14 owner of a covered foreign software shall not be considered 15 a provider of an interactive computer service for purposes 16 of subsection (c) of such section with respect to such cov- 17 ered foreign software. 18 (d) ENFORCEMENT BY FEDERAL TRADE COMMIS- 19 SION.— 20 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 21 TICES.—A violation of this section or a regulation 22 promulgated under this section shall be treated as a 23 violation of a regulation under section 18(a)(1)(B) 24 of the Federal Trade Commission Act (15 U.S.C. 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 10 •S 47 IS 57a(a)(1)(B)) regarding unfair or deceptive acts or 1 practices. 2 (2) POWERS OF COMMISSION.— 3 (A) IN GENERAL.—The Commission shall 4 enforce this section and the regulations promul- 5 gated under the section in the same manner, by 6 the same means, and with the same jurisdic- 7 tion, powers, and duties as though all applicable 8 terms and provisions of the Federal Trade 9 Commission Act (15 U.S.C. 41 et seq.) were in- 10 corporated into and made a part of this Act. 11 Any person who violates this section or a regu- 12 lation promulgated under this section shall be 13 subject to the penalties and entitled to the 14 privileges and immunities provided in the Fed- 15 eral Trade Commission Act. 16 (B) ADDITIONAL RELIEF.—In addition to 17 the penalties provided in the Federal Trade 18 Commission Act (15 U.S.C. 41 et seq.), if a 19 court or the Commission (in a formal adjudica- 20 tive proceeding) determines that an owner of 21 covered foreign software violated this section or 22 a regulation promulgated under this section, the 23 court or the Commission shall prohibit the 24 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 11 •S 47 IS owner from making such software available for 1 sale or download in the United States. 2 (3) REGULATIONS.—The Commission may pro- 3 mulgate regulations under section 553 of title 5, 4 United States Code, to carry out this section. 5 (4) SAVINGS CLAUSE.—Nothing in this section 6 shall be construed to limit the authority of the Com- 7 mission under any other provision of law. 8 (e) CRIMINAL OFFENSE.— 9 (1) IN GENERAL.—A software marketplace op- 10 erator or an owner of covered foreign software that 11 knowingly violates subsection (a) or (b) shall be 12 fined $50,000 for each violation. 13 (2) CLARIFICATIONS.— 14 (A) SEPARATE VIOLATION.—For purposes 15 of paragraph (1), each download by a consumer 16 of a covered foreign software that does not 17 meet the requirements of subparagraph (A) of 18 subsection (a)(1) or is made available in viola- 19 tion of subparagraph (B) of such subsection 20 shall be treated as a separate violation. 21 (B) INDIVIDUAL OFFENSE.—An officer of 22 a software marketplace operator or of an owner 23 of covered foreign software who knowingly 24 causes a violation of subsection (a)(1) with the 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 12 •S 47 IS intent to conceal the fact that the software is 1 covered foreign software shall be fined under 2 title 18, United States Code. 3 (3) REFERRAL OF EVIDENCE BY FTC.—When- 4 ever the Commission obtains evidence that a soft- 5 ware marketplace operator or owner of covered for- 6 eign software has engaged in conduct that may con- 7 stitute a violation of subsection (a) or (b), the Com- 8 mission shall transmit such evidence to the Attorney 9 General of the United States, who may institute 10 criminal proceedings under this subsection. Nothing 11 in this paragraph affects any other authority of the 12 Commission to disclose information. 13 (f) REPORT TO CONGRESS.—Not later than 1 year 14 after the date of the enactment of this Act, the Commis- 15 sion, in consultation with the Attorney General of the 16 United States, shall submit to Congress a report on the 17 implementation and enforcement of this section. 18 (g) EXPANSION OF COVERED TRANSACTIONS UNDER 19 THE DPA.—Section 721(a)(4)(B)(iii)(III) of the Defense 20 Production Act of 1950 (50 U.S.C. 21 4565(a)(4)(B)(iii)(III)) is amended by inserting ‘‘or com- 22 mercially available’’ after ‘‘sensitive’’. 23 (h) EXPRESS PREEMPTION OF STATE LAW.—This 24 Act shall supersede any provision of a law, regulation, or 25 VerDate Sep 11 2014 04:12 Feb 06, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S47.IS S47 kjohnson on DSK79L0C42PROD with BILLS 13 •S 47 IS other requirement of any State or political subdivision of 1 a State to the extent that such provision relates to the 2 privacy or se [Text truncated for display. Full text available on Congress.gov.]