What This Bill Does
This bill requires large internet platforms to tell users what information they collect and get permission before collecting or sharing that information. The bill applies to websites and apps with at least 30 million monthly users in the U.S. that use computer programs (called algorithms) to decide what content to show or hide from users.
Who It Affects
Large internet platforms including social networks, video sharing services, search engines, email services, mobile apps and mobile operating systems with at least 30 million active monthly U.S. users. Individual users of those platforms. The Federal Trade Commission, which enforces the law.
Key Provisions
• Internet platforms must get a user's clear permission before collecting personal data about that user's habits, traits, preferences, beliefs or location (Sec. 2(c)(1)(A))
• Users can stop a platform from collecting their personal data at any time and can ask the platform to delete data it already collected (Sec. 2(c)(1)(B))
• Internet platforms must get a user's clear permission before selling, sharing or giving personal data to other companies (Sec. 2(c)(2)(A))
• Platforms must tell users in plain, easy-to-read language each time they log in what data is collected, how it will be used, and if any data will be sold or shared to other companies (Sec. 2(c)(3))
• If platforms break these rules, people can sue in court and win at least $5,000 or actual damages plus lawyer fees (Sec. 3(b))
What Changes
One year after the law passes, large internet platforms must stop collecting personal data without first getting a user's permission. Platforms must provide clear notices to users before collecting or sharing their data. Users gain the ability to revoke consent and request deletion of their personal data. Individuals can now sue platforms in court for violations, not just rely on the Federal Trade Commission to take action.
Important Definitions
Covered data: information about a person's habits, traits, preferences, beliefs or location.
Covered platform: a website, internet application or mobile app with at least 30 million active monthly U.S. users that uses an algorithm to increase or decrease how visible content is on that platform.
Effective Date
One year after the bill becomes law (Sec. 2(a))
II
118TH CONGRESS
1ST SESSION
S. 688
To impose notice and consent requirements on internet platforms that use
algorithms to manipulate the availability of content on the platform.
IN THE SENATE OF THE UNITED STATES
MARCH 7, 2023
Mr. SCOTT of Florida introduced the following bill; which was read twice and
referred to the Committee on Commerce, Science, and Transportation
A BILL
To impose notice and consent requirements on internet plat-
forms that use algorithms to manipulate the availability
of content on the platform.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Data and Algorithm
4
Transparency Agreement Act’’ or the ‘‘DATA Act’’.
5
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
2
•S 688 IS
SEC. 2. NOTICE AND CONSENT REQUIREMENTS FOR INTER-
1
NET PLATFORMS THAT USE ALGORITHMS TO
2
MANIPULATE THE AVAILABILITY OF PLAT-
3
FORM CONTENT.
4
(a) IN GENERAL.—Beginning 1 year after the date
5
of enactment of this Act, any covered platform shall com-
6
ply with the requirements of subsection (c).
7
(b) DEFINITIONS.—In this Act:
8
(1) COVERED DATA.—The term ‘‘covered data’’
9
means, with respect to an individual, data regarding
10
the habits, traits, preferences, beliefs, or location of
11
the individual.
12
(2) COVERED PLATFORM.—the term ‘‘covered
13
platform’’ means a public-facing website, internet
14
application, or mobile internet application, including
15
a social network, video sharing service, ad network,
16
mobile operating system, search engine, email serv-
17
ice, or internet access service that—
18
(A) has not less than 30,000,000 active
19
monthly users in the United States; and
20
(B) uses an algorithm to increase or de-
21
crease the availability of content on the website
22
or application.
23
(c) REQUIREMENTS.—
24
(1) NO COLLECTION OF COVERED DATA WITH-
25
OUT CONSENT.—
26
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
3
•S 688 IS
(A) IN
GENERAL.—A covered platform
1
shall not collect any covered data of an indi-
2
vidual without obtaining the individual’s express
3
consent for such data collection.
4
(B) REVOCATION OF CONSENT; RIGHT TO
5
DELETE.—A covered platform shall—
6
(i) allow any individual to revoke or
7
withdraw the individual’s prior consent to
8
the covered platform collecting the individ-
9
ual’s covered data; and
10
(ii) at the request of an individual, de-
11
lete any covered data of the individual col-
12
lected or held by the platform.
13
(2) NO SALE, SHARING, OR CONVEYANCE OF
14
DATA WITHOUT CONSENT.—
15
(A) IN
GENERAL.—A covered platform
16
shall not sell, share, or otherwise convey to a
17
third party entity any covered data of an indi-
18
vidual without obtaining the individual’s express
19
consent.
20
(B) REVOCATION OF CONSENT.—A covered
21
platform shall allow any individual to revoke or
22
withdraw the individual’s prior consent to any
23
sale, sharing, or conveyance of the individual’s
24
covered data.
25
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
4
•S 688 IS
(3) NOTICE OF REQUIREMENTS.—
1
(A) IN
GENERAL.—A covered platform
2
shall provide notice to users of the platform of
3
the requirements described in paragraphs (1)
4
and (2).
5
(B) MANNER OF NOTIFICATION.—The no-
6
tice required under subparagraph (A) shall con-
7
tain the information described in subparagraph
8
(C) and shall be provided by a covered platform
9
to a user—
10
(i) in plain language and in a con-
11
spicuous manner;
12
(ii) in addition to any notice relating
13
to the terms of service of the platform;
14
(iii) each time the user logs in to the
15
platform unless the user affirmatively
16
waives receiving the notice; and
17
(iv) each time the platform modifies
18
its terms of service.
19
(C) CONTENTS OF NOTIFICATION.—A no-
20
tice required under this paragraph shall include
21
the following:
22
(i) With respect to the collection of
23
covered data by a covered platform—
24
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
5
•S 688 IS
(I) the type of data to be col-
1
lected;
2
(II) whether the collection of
3
data will continue beyond the user’s
4
immediate use of the covered plat-
5
form; and
6
(III) how the data will be used by
7
the covered platform.
8
(ii) With respect to the sale, sharing,
9
or conveyance of covered data by a covered
10
platform—
11
(I) the specific data that will be
12
sold, shared, or otherwise conveyed to
13
a third party entity;
14
(II) the name of any third party
15
entity to which data will be sold,
16
shared, or otherwise conveyed; and
17
(III) the country of origin of the
18
third party entity to which the data
19
will be sold, shared, or conveyed.
20
SEC. 3. ENFORCEMENT.
21
(a) ENFORCEMENT BY THE FEDERAL TRADE COM-
22
MISSION.—
23
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
24
TICES.—A violation of this Act or a regulation pro-
25
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
6
•S 688 IS
mulgated under this Act shall be treated as an un-
1
fair or deceptive act or practice in violation of a rule
2
promulgated under section 18(a)(1)(B) of the Fed-
3
eral
Trade
Commission
Act
(15
U.S.C.
4
57a(a)(1)(B)).
5
(2) POWERS OF THE COMMISSION.—
6
(A) IN
GENERAL.—The Federal Trade
7
Commission shall enforce this Act and any reg-
8
ulation promulgated under this Act in the same
9
manner, by the same means, and with the same
10
jurisdiction, powers, and duties as though all
11
applicable terms and provisions of the Federal
12
Trade Commission Act (15 U.S.C. 41 et seq.)
13
were incorporated into and made a part of this
14
Act.
15
(B) PRIVILEGES
AND
IMMUNITIES.—Any
16
covered entity who violates this Act or a regula-
17
tion promulgated under this Act shall be sub-
18
ject to the penalties and entitled to the privi-
19
leges and immunities provided in the Federal
20
Trade Commission Act (15 U.S.C. 41 et seq.).
21
(b) PRIVATE RIGHT OF ACTION.—
22
(1) IN GENERAL.—An individual alleging a vio-
23
lation of this Act may bring a civil action in any
24
court of competent jurisdiction, State or Federal.
25
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS
7
•S 688 IS
(2) INJURY IN FACT.—A violation of this Act
1
with respect to the requirements to notify and obtain
2
the express consent of the user before the user’s
3
data may be collected, sold, shared, or otherwise
4
conveyed to a third-party entity constitutes a con-
5
crete and particularized injury in fact to that indi-
6
vidual.
7
(3) RELIEF.—In a civil action brought under
8
paragraph (1) in which the plaintiff prevails, the
9
court shall award—
10
(A) the greater of—
11
(i) not less than $5,000; and
12
(ii) actual damages; and
13
(B) reasonable attorney’s fees and litiga-
14
tion costs.
15
(c) RULEMAKING.—The Federal Trade Commission
16
shall promulgate in accordance with section 553 of title
17
5, United States Code, such rules as may be necessary
18
to carry out this Act.
19
Æ
VerDate Sep 11 2014
00:18 Mar 16, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6301
E:\BILLS\S688.IS
S688
kjohnson on DSK79L0C42PROD with BILLS