Social Media Privacy Protection and Consumer Rights Act of 2021

II 117TH CONGRESS 1ST SESSION S. 1667 To protect the privacy of users of social media and other online platforms. IN THE SENATE OF THE UNITED STATES MAY 18, 2021 Ms. KLOBUCHAR (for herself, Mr. KENNEDY, Mr. MANCHIN, and Mr. BURR) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect the privacy of users of social media and other online platforms. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Social Media Privacy 4 Protection and Consumer Rights Act of 2021’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 (1) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1667 IS (2) COVERED ONLINE PLATFORM.—The term 1 ‘‘covered online platform’’ means an online platform 2 that collects personal data during the online behav- 3 ior of a user of the online platform. 4 (3) GEOLOCATION INFORMATION.—The term 5 ‘‘geolocation information’’ means, with respect to an 6 individual, any information that is not the content of 7 a communication, concerning the location of a wire- 8 less communication device that— 9 (A) in whole or in part, is generated by or 10 derived from the operation of that device; and 11 (B) could be used to determine or infer in- 12 formation regarding the location of the indi- 13 vidual. 14 (4) ONLINE PLATFORM.—The term ‘‘online 15 platform’’— 16 (A) means any public-facing website, web 17 application, or digital application (including a 18 mobile application); and 19 (B) includes a social network, an ad net- 20 work, a mobile operating system, a search en- 21 gine, an email service, or an internet access 22 service. 23 (5) OPERATOR.—The term ‘‘operator’’ has the 24 meaning given the term in section 1302 of the Chil- 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1667 IS dren’s Online Privacy Protection Act of 1998 (15 1 U.S.C. 6501). 2 (6) PERSONAL DATA.—The term ‘‘personal 3 data’’ means individually identifiable information 4 about an individual collected online, including— 5 (A) location information sufficient to iden- 6 tify the name of a street and a city or town, in- 7 cluding a physical address; 8 (B) an email address; 9 (C) a telephone number; 10 (D) a government identifier, such as a So- 11 cial Security number; 12 (E) geolocation information; 13 (F) the content of a message; 14 (G) protected health information, as de- 15 fined in section 160.103 of title 45, Code of 16 Federal Regulations, or any successor regula- 17 tion; and 18 (H) nonpublic personal information, as de- 19 fined in section 509 of the Gramm-Leach-Bliley 20 Act (15 U.S.C. 6809). 21 SEC. 3. PRIVACY PROTECTIONS. 22 (a) TRANSPARENCY AND TERMS OF SERVICE.— 23 (1) DISCLOSURE AND OBTAINING INITIAL CON- 24 SENT AND PRIVACY PREFERENCES.— 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1667 IS (A) IN GENERAL.—Before a user creates 1 an account with, or otherwise begins to use, a 2 covered online platform, the operator of the on- 3 line platform shall— 4 (i) inform the user that, unless the 5 user makes an election under clause 6 (ii)(II), personal data of the user produced 7 during the online behavior of the user, 8 whether on the online platform or other- 9 wise, will be collected and used by the op- 10 erator and third parties; and 11 (ii) provide the user the option to 12 specify the privacy preferences of the user, 13 including by— 14 (I) agreeing to the terms of serv- 15 ice for use of the online platform, in- 16 cluding, except as provided in sub- 17 clause (II), the collection and use of 18 personal data described in clause (i); 19 and 20 (II) prohibiting, if the user so 21 elects, the collection and use of per- 22 sonal data described in clause (i), sub- 23 ject to subparagraph (B). 24 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1667 IS (B) CONSEQUENCE OF PROHIBITION OF 1 DATA COLLECTION.—If the election of a user 2 under subparagraph (A)(ii)(II) creates inoper- 3 ability in the online platform, the operator of 4 the online platform may deny certain services or 5 completely deny access to the user. 6 (C) FORM OF DISCLOSURE.—An operator 7 of a covered online platform shall provide a user 8 of the online platform with the terms of service 9 for use of the online platform, including the col- 10 lection and use of personal data described in 11 subparagraph (A)(i), in a form that— 12 (i) is— 13 (I) easily accessible; 14 (II) of reasonable length; and 15 (III) clearly distinguishable from 16 other matters; and 17 (ii) uses language that is clear, con- 18 cise, and well organized, and follows other 19 best practices appropriate to the subject 20 and intended audience. 21 (D) PRIVACY OR SECURITY PROGRAM.—An 22 operator of a covered online platform shall— 23 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1667 IS (i) establish and maintain a privacy or 1 security program for the online platform; 2 and 3 (ii) publish a description of the pri- 4 vacy or security program that— 5 (I) details how the operator will 6 use the personal data of a user of the 7 online platform, including require- 8 ments for how the operator will ad- 9 dress privacy risks associated with the 10 development of new products and 11 services; and 12 (II) includes details of the access 13 that employees and contractors of the 14 operator have to the personal data of 15 a user of the online platform, and in- 16 ternal policies for the use of that per- 17 sonal data. 18 (2) NEW PRODUCTS; CHANGES TO PRIVACY OR 19 SECURITY PROGRAM.—An operator of a covered on- 20 line platform may not introduce a new product, or 21 implement any material change to the privacy or se- 22 curity program of the online platform that overrides 23 the privacy preferences of a user of the online plat- 24 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1667 IS form, as specified under paragraph (1)(A)(ii), unless 1 the operator has— 2 (A) informed the user that the new prod- 3 uct or change will result in the collection and 4 use of personal data described in paragraph 5 (1)(A)(i), if that is the case; 6 (B) provided the user the option under 7 paragraph (1)(A)(ii); and 8 (C) obtained affirmative express consent 9 from the user to the introduction of the new 10 product or the implementation of the change. 11 (3) WITHDRAWAL OF CONSENT.—An operator 12 of a covered online platform shall ensure that— 13 (A) a user of the online platform is able to 14 withdraw consent to the terms of service for use 15 of the online platform, including the collection 16 and use of personal data described in para- 17 graph (1)(A)(i), as easily as the user is able to 18 give such consent; and 19 (B) except as otherwise required by law, no 20 person is able to access the personal data of a 21 user of the online platform later than 30 days 22 after the date on which the user closes his or 23 her account or otherwise terminates his or her 24 use of the online platform. 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1667 IS (b) RIGHT TO ACCESS.—An operator of a covered on- 1 line platform shall offer a user of the online platform a 2 copy of the personal data of the user that the operator 3 has processed, free of charge and in an electronic and eas- 4 ily accessible format, including a list of each person that 5 received the personal data from the operator for business 6 purposes, whether through sale or other means. 7 (c) VIOLATIONS OF PRIVACY.— 8 (1) IN GENERAL.—Not later than 72 hours 9 after an operator of a covered online platform be- 10 comes aware that the personal data of a user of the 11 online platform has been transmitted in violation of 12 the privacy or security program of the online plat- 13 form, including the privacy preferences specified by 14 the user under subsection (a)(1)(A)(ii), the operator 15 shall— 16 (A) notify the user of the transmission; 17 (B) offer the user the option to elect to 18 prohibit the operator from collecting and using 19 the personal data of the user, subject to para- 20 graph (2); 21 (C) except as provided in paragraph (3), 22 offer the user the option to have the operator— 23 (i) erase all personal data of the user 24 tracked by the operator; and 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1667 IS (ii) cease further dissemination of per- 1 sonal data of the user tracked by the oper- 2 ator; 3 (D) offer the user a copy of the personal 4 data of the user in accordance with subsection 5 (b); and 6 (E) offer the user the option to close his 7 or her account or otherwise terminate his or her 8 use of the online platform. 9 (2) CONSEQUENCE OF PROHIBITION OF DATA 10 COLLECTION.—If the election of a user under para- 11 graph (1)(B) creates inoperability in the online plat- 12 form, the operator of the online platform may deny 13 certain services or completely deny access to the 14 user. 15 (3) PUBLIC SAFETY EXCEPTION.—If the oper- 16 ator of a covered online platform, in good faith, be- 17 lieves that an emergency involving danger of death 18 or serious physical injury to any individual requires 19 disclosure without delay of specific personal data of 20 a user of the online platform that relates to the 21 emergency, the operator shall— 22 (A) retain the specific personal data; and 23 (B) notify the proper authorities. 24 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 10 •S 1667 IS (d) COMPLIANCE.—Not less frequently than once 1 every 2 years, the operator of a covered online platform 2 shall audit the privacy or security program of the online 3 platform. 4 (e) SAFE HARBOR.—Subsections (a), (b), and (c) 5 shall not apply with respect to the development of privacy- 6 enhancing technology by an operator of an online plat- 7 form. 8 SEC. 4. ENFORCEMENT. 9 (a) ENFORCEMENT BY COMMISSION.— 10 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 11 TICES.—A violation of section 3 shall be treated as 12 a violation of a rule defining an unfair or deceptive 13 act or practice prescribed under section 18(a)(1)(B) 14 of the Federal Trade Commission Act (15 U.S.C. 15 57a(a)(1)(B)). 16 (2) POWERS OF COMMISSION.— 17 (A) IN GENERAL.—Except as provided in 18 subparagraph (C), the Commission shall enforce 19 this Act in the same manner, by the same 20 means, and with the same jurisdiction, powers, 21 and duties as though all applicable terms and 22 provisions of the Federal Trade Commission 23 Act (15 U.S.C. 41 et seq.) were incorporated 24 into and made a part of this Act. 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 11 •S 1667 IS (B) PRIVILEGES AND IMMUNITIES.—Ex- 1 cept as provided in subparagraph (C), any per- 2 son who violates this Act shall be subject to the 3 penalties and entitled to the privileges and im- 4 munities provided in the Federal Trade Com- 5 mission Act (15 U.S.C. 41 et seq.). 6 (C) COMMON CARRIERS AND NONPROFIT 7 ORGANIZATIONS.—Notwithstanding section 4, 8 5(a)(2), or 6 of the Federal Trade Commission 9 Act (15 U.S.C. 44, 45(a)(2), 46) or any juris- 10 dictional limitation of the Commission, the 11 Commission shall also enforce this Act, in the 12 same manner provided in subparagraphs (A) 13 and (B) of this paragraph, with respect to— 14 (i) common carriers subject to the 15 Communications Act of 1934 (47 U.S.C. 16 151 et seq.) and Acts amendatory thereof 17 and supplementary thereto; and 18 (ii) organizations not organized to 19 carry on business for their own profit or 20 that of their members. 21 (D) AUTHORITY PRESERVED.—Nothing in 22 this Act shall be construed to limit the author- 23 ity of the Commission under any other provi- 24 sion of law. 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 12 •S 1667 IS (b) ENFORCEMENT BY STATES.— 1 (1) AUTHORIZATION.—Subject to paragraph 2 (2), in any case in which the attorney general of a 3 State has reason to believe, based on a legitimate 4 consumer complaint, that an interest of the residents 5 of the State has been or is threatened or adversely 6 affected by the engagement of any person subject to 7 section 3 in a practice that violates that section, the 8 attorney general of the State may, as parens patriae, 9 bring a civil action on behalf of the residents of the 10 State in an appropriate district court of the United 11 States to obtain appropriate relief. 12 (2) RIGHTS OF FEDERAL TRADE COMMIS- 13 SION.— 14 (A) NOTICE TO FEDERAL TRADE COMMIS- 15 SION.— 16 (i) IN GENERAL.—Except as provided 17 in clause (iii), the attorney general of a 18 State shall notify the Commission in writ- 19 ing that the attorney general intends to 20 bring a civil action under paragraph (1) 21 before initiating the civil action against a 22 person subject to this Act. 23 (ii) CONTENTS.—The notification re- 24 quired by clause (i) with respect to a civil 25 VerDate Sep 11 2014 02:17 May 28, 2021 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1667.IS S1667 kjohnson on DSK79L0C42PROD with BILLS 13 •S 1667 IS action shall include a copy of the complaint 1 to be filed to initiate the civil action. 2 (iii) EXCEPTION.—If it is not feasible 3 for the attorney general of a State to pro- 4 vide the notification required by clause (i) 5 before initiating a civil action under para- 6 graph (1), the attorney general shall notify 7 the Commission immediately upon insti- 8 tuting the civil action. 9 (B) INTERVENTION BY FEDERAL TRADE 10 COMMISSION.—The Commission may— 11 (i) intervene in any civil action 12 brought by the attorney general of a State 13 under paragraph (1); and [Text truncated for display. Full text available on Congress.gov.]