Social Media Privacy Protection and Consumer Rights Act of 2019

II 116TH CONGRESS 1ST SESSION S. 189 To protect the privacy of users of social media and other online platforms. IN THE SENATE OF THE UNITED STATES JANUARY 17, 2019 Ms. KLOBUCHAR (for herself and Mr. KENNEDY) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect the privacy of users of social media and other online platforms. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Social Media Privacy 4 Protection and Consumer Rights Act of 2019’’. 5 SEC. 2. DEFINITIONS. 6 In this Act— 7 (1) the term ‘‘Commission’’ means the Federal 8 Trade Commission; 9 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 189 IS (2) the term ‘‘covered online platform’’ means 1 an online platform that collects personal data during 2 the online behavior of a user of the online platform; 3 (3) the term ‘‘geolocation information’’ means, 4 with respect to an individual, any information that 5 is not the content of a communication, concerning 6 the location of a wireless communication device 7 that— 8 (A) in whole or in part, is generated by or 9 derived from the operation of that device; and 10 (B) could be used to determine or infer in- 11 formation regarding the location of the indi- 12 vidual; 13 (4) the term ‘‘online platform’’— 14 (A) means any public-facing website, web 15 application, or digital application (including a 16 mobile application); and 17 (B) includes a social network, an ad net- 18 work, a mobile operating system, a search en- 19 gine, an email service, or an internet access 20 service; 21 (5) the term ‘‘operator’’ has the meaning given 22 the term in section 1302 of the Children’s Online 23 Privacy Protection Act of 1998 (15 U.S.C. 6501); 24 and 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 189 IS (6) the term ‘‘personal data’’ means individ- 1 ually identifiable information about an individual 2 collected online, including— 3 (A) location information sufficient to iden- 4 tify the name of a street and a city or town, in- 5 cluding a physical address; 6 (B) an email address; 7 (C) a telephone number; 8 (D) a government identifier, such as a So- 9 cial Security number; 10 (E) geolocation information; 11 (F) the content of a message; 12 (G) protected health information, as de- 13 fined in section 160.103 of title 45, Code of 14 Federal Regulations, or any successor regula- 15 tion; and 16 (H) nonpublic personal information, as de- 17 fined in section 509 of the Gramm-Leach-Bliley 18 Act (15 U.S.C. 6809). 19 SEC. 3. PRIVACY PROTECTIONS. 20 (a) TRANSPARENCY AND TERMS OF SERVICE.— 21 (1) DISCLOSURE AND OBTAINING INITIAL CON- 22 SENT AND PRIVACY PREFERENCES.— 23 (A) IN GENERAL.—Before a user creates 24 an account with, or otherwise begins to use, a 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 189 IS covered online platform, the operator of the on- 1 line platform shall— 2 (i) inform the user that, unless the 3 user makes an election under clause 4 (ii)(II), personal data of the user produced 5 during the online behavior of the user, 6 whether on the online platform or other- 7 wise, will be collected and used by the op- 8 erator and third parties; and 9 (ii) provide the user the option to 10 specify the privacy preferences of the user, 11 including by— 12 (I) agreeing to the terms of serv- 13 ice for use of the online platform, in- 14 cluding, except as provided in sub- 15 clause (II), the collection and use of 16 personal data described in clause (i); 17 and 18 (II) prohibiting, if the user so 19 elects, the collection and use of per- 20 sonal data described in clause (i), sub- 21 ject to subparagraph (B). 22 (B) CONSEQUENCE OF PROHIBITION OF 23 DATA COLLECTION.—If the election of a user 24 under subparagraph (A)(ii)(II) creates inoper- 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 189 IS ability in the online platform, the operator of 1 the online platform may deny certain services or 2 completely deny access to the user. 3 (C) FORM OF DISCLOSURE.—An operator 4 of a covered online platform shall provide a user 5 of the online platform with the terms of service 6 for use of the online platform, including the col- 7 lection and use of personal data described in 8 subparagraph (A)(i), in a form that— 9 (i) is— 10 (I) easily accessible; 11 (II) of reasonable length; and 12 (III) clearly distinguishable from 13 other matters; and 14 (ii) uses language that is clear, con- 15 cise, and well organized, and follows other 16 best practices appropriate to the subject 17 and intended audience. 18 (D) PRIVACY OR SECURITY PROGRAM.—An 19 operator of a covered online platform shall— 20 (i) establish and maintain a privacy or 21 security program for the online platform; 22 and 23 (ii) publish a description of the pri- 24 vacy or security program that— 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 189 IS (I) details how the operator will 1 use the personal data of a user of the 2 online platform, including require- 3 ments for how the operator will ad- 4 dress privacy risks associated with the 5 development of new products and 6 services; and 7 (II) includes details of the access 8 that employees and contractors of the 9 operator have to the personal data of 10 a user of the online platform, and in- 11 ternal policies for the use of that per- 12 sonal data. 13 (2) NEW PRODUCTS; CHANGES TO PRIVACY OR 14 SECURITY PROGRAM.—An operator of a covered on- 15 line platform may not introduce a new product, or 16 implement any material change to the privacy or se- 17 curity program of the online platform that overrides 18 the privacy preferences of a user of the online plat- 19 form, as specified under paragraph (1)(A)(ii), unless 20 the operator has— 21 (A) informed the user that the new prod- 22 uct or change will result in the collection and 23 use of personal data described in paragraph 24 (1)(A)(i), if that is the case; 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 7 •S 189 IS (B) provided the user the option under 1 paragraph (1)(A)(ii); and 2 (C) obtained affirmative express consent 3 from the user to the introduction of the new 4 product or the implementation of the change. 5 (3) WITHDRAWAL OF CONSENT.—An operator 6 of a covered online platform shall ensure that— 7 (A) a user of the online platform is able to 8 withdraw consent to the terms of service for use 9 of the online platform, including the collection 10 and use of personal data described in para- 11 graph (1)(A)(i), as easily as the user is able to 12 give such consent; and 13 (B) except as otherwise required by law, no 14 person is able to access the personal data of a 15 user of the online platform later than 30 days 16 after the date on which the user closes his or 17 her account or otherwise terminates his or her 18 use of the online platform. 19 (b) RIGHT TO ACCESS.—An operator of a covered on- 20 line platform shall offer a user of the online platform a 21 copy of the personal data of the user that the operator 22 has processed, free of charge and in an electronic and eas- 23 ily accessible format, including a list of each person that 24 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 8 •S 189 IS received the personal data from the operator for business 1 purposes, whether through sale or other means. 2 (c) VIOLATIONS OF PRIVACY.— 3 (1) IN GENERAL.—Not later than 72 hours 4 after an operator of a covered online platform be- 5 comes aware that the personal data of a user of the 6 online platform has been transmitted in violation of 7 the privacy or security program of the online plat- 8 form, including the privacy preferences specified by 9 the user under subsection (a)(1)(A)(ii), the operator 10 shall— 11 (A) notify the user of the transmission; 12 (B) offer the user the option to elect to 13 prohibit the operator from collecting and using 14 the personal data of the user, subject to para- 15 graph (2); 16 (C) except as provided in paragraph (3), 17 offer the user the option to have the operator— 18 (i) erase all personal data of the user 19 tracked by the operator; and 20 (ii) cease further dissemination of per- 21 sonal data of the user tracked by the oper- 22 ator; 23 (D) offer the user a copy of the personal 24 data of the user that the operator has proc- 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 9 •S 189 IS essed, free of charge and in an electronic and 1 easily accessible format, including a list of each 2 person that received the personal data from the 3 operator, whether through sale or other means; 4 and 5 (E) offer the user the option to close his 6 or her account or otherwise terminate his or her 7 use of the online platform. 8 (2) CONSEQUENCE OF PROHIBITION OF DATA 9 COLLECTION.—If the election of a user under para- 10 graph (1)(B) creates inoperability in the online plat- 11 form, the operator of the online platform may deny 12 certain services or completely deny access to the 13 user. 14 (3) PUBLIC SAFETY EXCEPTION.—If the oper- 15 ator of a covered online platform, in good faith, be- 16 lieves that an emergency involving danger of death 17 or serious physical injury to any individual requires 18 disclosure without delay of specific personal data of 19 a user of the online platform that relates to the 20 emergency, the operator shall— 21 (A) retain the specific personal data; and 22 (B) notify the proper authorities. 23 (d) COMPLIANCE.—Not less frequently than once 24 every 2 years, the operator of a covered online platform 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 10 •S 189 IS shall audit the privacy or security program of the online 1 platform. 2 (e) SAFE HARBOR.—Subsections (a), (b), and (c) 3 shall not apply with respect to the development of privacy- 4 enhancing technology by an operator of an online plat- 5 form. 6 SEC. 4. ENFORCEMENT. 7 (a) ENFORCEMENT BY COMMISSION.— 8 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC- 9 TICES.—A violation of section 3 shall be treated as 10 a violation of a rule defining an unfair or deceptive 11 act or practice prescribed under section 18(a)(1)(B) 12 of the Federal Trade Commission Act (15 U.S.C. 13 57a(a)(1)(B)). 14 (2) POWERS OF COMMISSION.— 15 (A) IN GENERAL.—Except as provided in 16 subparagraph (C), the Commission shall enforce 17 this Act in the same manner, by the same 18 means, and with the same jurisdiction, powers, 19 and duties as though all applicable terms and 20 provisions of the Federal Trade Commission 21 Act (15 U.S.C. 41 et seq.) were incorporated 22 into and made a part of this Act. 23 (B) PRIVILEGES AND IMMUNITIES.—Ex- 24 cept as provided in subparagraph (C), any per- 25 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 11 •S 189 IS son who violates this Act shall be subject to the 1 penalties and entitled to the privileges and im- 2 munities provided in the Federal Trade Com- 3 mission Act (15 U.S.C. 41 et seq.). 4 (C) COMMON CARRIERS AND NONPROFIT 5 ORGANIZATIONS.—Notwithstanding section 4, 6 5(a)(2), or 6 of the Federal Trade Commission 7 Act (15 U.S.C. 44, 45(a)(2), 46) or any juris- 8 dictional limitation of the Commission, the 9 Commission shall also enforce this Act, in the 10 same manner provided in subparagraphs (A) 11 and (B) of this paragraph, with respect to— 12 (i) common carriers subject to the 13 Communications Act of 1934 (47 U.S.C. 14 151 et seq.) and Acts amendatory thereof 15 and supplementary thereto; and 16 (ii) organizations not organized to 17 carry on business for their own profit or 18 that of their members. 19 (D) AUTHORITY PRESERVED.—Nothing in 20 this Act shall be construed to limit the author- 21 ity of the Commission under any other provi- 22 sion of law. 23 (b) ENFORCEMENT BY STATES.— 24 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 12 •S 189 IS (1) AUTHORIZATION.—Subject to paragraph 1 (2), in any case in which the attorney general of a 2 State has reason to believe, based on a legitimate 3 consumer complaint, that an interest of the residents 4 of the State has been or is threatened or adversely 5 affected by the engagement of any person subject to 6 section 3 in a practice that violates that section, the 7 attorney general of the State may, as parens patriae, 8 bring a civil action on behalf of the residents of the 9 State in an appropriate district court of the United 10 States to obtain appropriate relief. 11 (2) RIGHTS OF FEDERAL TRADE COMMIS- 12 SION.— 13 (A) NOTICE TO FEDERAL TRADE COMMIS- 14 SION.— 15 (i) IN GENERAL.—Except as provided 16 in clause (iii), the attorney general of a 17 State shall notify the Commission in writ- 18 ing that the attorney general intends to 19 bring a civil action under paragraph (1) 20 before initiating the civil action against a 21 person described in subsection (a)(1). 22 (ii) CONTENTS.—The notification re- 23 quired by clause (i) with respect to a civil 24 VerDate Sep 11 2014 00:32 Jan 26, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S189.IS S189 pamtmann on DSKBFK8HB2PROD with BILLS 13 •S 189 IS action shall include a copy of the complaint 1 to be filed to initiate the civil action. 2 (iii) EXCEPTION.—If it is not feasible 3 for the attorney general of a State to pro- 4 vide the notification required by clause (i) 5 before initiating a civil action under para- 6 graph (1), the attorney general shall notify 7 the Commission immediately upon insti- 8 tuting the civil action. 9 (B) INTERVENTION BY FEDERAL TRADE 10 COMMISSION.—The Commission may— 11 (i) intervene in any civil action 12 brought by the attorney gen [Text truncated for display. Full text available on Congress.gov.]