Know Your App Act

II 118TH CONGRESS 1ST SESSION S. 1732 To require application stores to publicly list the country of origin of the applications that they distribute, and to provide consumers the ability to protect themselves. IN THE SENATE OF THE UNITED STATES MAY 18, 2023 Mr. SCOTT of South Carolina (for himself, Mr. WICKER, and Mr. LANKFORD) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require application stores to publicly list the country of origin of the applications that they distribute, and to provide consumers the ability to protect themselves. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Know Your App Act’’. 4 SEC. 2. FINDINGS; SENSE OF CONGRESS. 5 (a) FINDINGS.—Congress finds the following: 6 (1) Minors engaging with internet-linked appli- 7 cations face heightened susceptibility to privacy risks 8 and potential exploitation through those applica- 9 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1732 IS tions. It is crucial for parents and guardians to pos- 1 sess comprehensive knowledge about the applications 2 being accessed so that they can make informed deci- 3 sions to protect their children. 4 (2) Many users are unaware of the country of 5 origin of the applications they download and use, as 6 well as the data handling practices of the developers 7 behind those applications. This lack of transparency 8 can lead to potential risks for users, including expo- 9 sure to foreign government surveillance, data 10 breaches, and privacy violations. Users have a right 11 to know baseline information on the country of ori- 12 gin so that they can personally make decisions to 13 mitigate the threat to their personal and biometric 14 information. 15 (3) The potential for foreign governments to ac- 16 cess user data through internet-linked applications 17 presents national security risks. These risks may in- 18 clude the collection of sensitive information, espio- 19 nage, and potential influence over critical infrastruc- 20 ture. 21 (4) Increasing transparency and providing users 22 with the necessary information to make informed de- 23 cisions about the applications they download can 24 help protect consumer privacy and security. 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1732 IS (b) SENSE OF CONGRESS.—It is the sense of Con- 1 gress that covered companies and developers already pos- 2 ses the information necessary to provide adequate trans- 3 parency to consumers. 4 SEC. 3. PUBLIC LISTING OF COUNTRY OF ORIGIN OF APPLI- 5 CATIONS. 6 (a) DEFINITIONS.—In this section: 7 (1) APPLICATION.—The term ‘‘application’’ 8 means a software application or electronic service 9 that may be run or directed by a user on a com- 10 puter, a mobile device, or any other general purpose 11 computing device. 12 (2) APPLICATION STORE.—The term ‘‘applica- 13 tion store’’ means a publicly available website, soft- 14 ware application, electronic service, or platform pro- 15 vided by a device manufacturer that— 16 (A) distributes applications from third- 17 party developers to users of a computer, a mo- 18 bile device, or any other general purpose com- 19 puting device; and 20 (B) has more than 20,000,000 users in the 21 United States. 22 (3) APPLICATION STORE PAGE.—The term ‘‘ap- 23 plication store page’’ means the individual, dedicated 24 listing page within an application store that serves 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1732 IS as the primary source of information on a specific 1 application and provides detailed information about 2 the application, including the name of the applica- 3 tion, the developer, a description, user ratings and 4 reviews, screenshots or previews, pricing, and system 5 requirements. 6 (4) ASSISTANT SECRETARY.—The term ‘‘Assist- 7 ant Secretary’’ means the Assistant Secretary of 8 Commerce for Communications and Information. 9 (5) BENEFICIAL OWNER.—The term ‘‘beneficial 10 owner’’— 11 (A) means, with respect to a developer of 12 an application, an individual who, directly or in- 13 directly, through any contract, arrangement, 14 understanding, relationship, or otherwise— 15 (i) exercises substantial control over 16 the developer; or 17 (ii) owns or controls not less than 25 18 percent of the ownership interests of the 19 developer; and 20 (B) does not include— 21 (i) a minor child, as defined in the 22 State in which the entity is formed, if the 23 information of the parent or guardian of 24 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1732 IS the minor child is reported in accordance 1 with this section; 2 (ii) an individual acting as a nominee, 3 intermediary, custodian, or agent on behalf 4 of another individual; 5 (iii) an individual acting solely as an 6 employee of a corporation, limited liability 7 company, or other similar entity and whose 8 control over or economic benefits from 9 such entity is derived solely from the em- 10 ployment status of the individual; 11 (iv) an individual whose only interest 12 in a corporation, limited liability company, 13 or other similar entity is through a right of 14 inheritance; or 15 (v) a creditor of a corporation, limited 16 liability company, or other similar entity, 17 unless the creditor meets the requirements 18 of subparagraph (A). 19 (6) COUNTRY OF CONCERN.—The term ‘‘coun- 20 try of concern’’ means a country that is on the list 21 described in section 4. 22 (7) COUNTRY OF ORIGIN.—The term ‘‘country 23 of origin’’— 24 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1732 IS (A) with respect to the developer of an ap- 1 plication, means the country in which the devel- 2 oper is headquartered or principally operates; 3 and 4 (B) with respect to the beneficial owner of 5 the developer of an application— 6 (i) except as provided in clause (ii), 7 means the country from which the bene- 8 ficial owner principally exercises control 9 over the developer; and 10 (ii) if the beneficial owner exercises 11 any control over the developer from a 12 country of concern, means that country. 13 (8) COVERED COMPANY.—The term ‘‘covered 14 company’’ means any person, entity, or organization 15 that owns, controls, or operates an application store 16 that serves customers in the United States. 17 (9) DEVELOPER.—The term ‘‘developer’’ means 18 a person that creates, owns, or controls an applica- 19 tion and is responsible for the design, development, 20 maintenance, and distribution of the application to 21 end users through an application store. 22 (10) PRIMARY COUNTRY OF ORIGIN.—The term 23 ‘‘primary country of origin’’, with respect to an ap- 24 plication— 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1732 IS (A) except as provided in subparagraph 1 (B), means the country of origin of the devel- 2 oper of the application; and 3 (B) if the country of origin of the bene- 4 ficial owner of the developer of the application 5 is a country of concern, means that country. 6 (11) PROMINENT DISPLAY.—The term ‘‘promi- 7 nent display’’, with respect to an application store 8 page, means a banner that is immediately and clear- 9 ly visible when the application store page is accessed. 10 (b) REQUIREMENTS.— 11 (1) PUBLIC LISTING.—The Assistant Secretary 12 shall require a covered company to publicly list, in 13 a prominent display on the application store page, 14 the primary country of origin of each application 15 distributed through an application store owned, con- 16 trolled, or operated by the covered company. 17 (2) PROTECTIONS REGARDING CERTAIN FOR- 18 EIGN COUNTRIES.— 19 (A) FILTER FOR CERTAIN APPLICA- 20 TIONS.—The Assistant Secretary shall require a 21 covered company to provide users of the covered 22 company’s application store with the option to 23 filter out applications whose primary country of 24 origin is a country of concern. 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1732 IS (B) DISCLAIMER FOR CERTAIN APPLICA- 1 TIONS.—The Assistant Secretary shall require 2 that if the primary country of origin of an ap- 3 plication is a country of concern, a covered 4 company that distributes the application 5 through an application store shall provide a dis- 6 claimer, in a prominent display on the applica- 7 tion store page, that data from the application 8 could be accessed by a foreign government. 9 (3) UPDATE OF INFORMATION.— 10 (A) IN GENERAL.—The Assistant Sec- 11 retary shall require a developer to notify a cov- 12 ered company whose application store distrib- 13 utes the developer’s application of any change 14 in— 15 (i) the country of origin of the devel- 16 oper; 17 (ii) the beneficial owner of the devel- 18 oper; or 19 (iii) the country of origin of the bene- 20 ficial owner of the developer. 21 (B) DEVELOPER CERTIFICATION.— 22 (i) IN GENERAL.—The Assistant Sec- 23 retary shall require a developer to certify 24 to each covered company that owns, con- 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1732 IS trols, or operates an application store 1 through which the developer’s application 2 is distributed, not less frequently than an- 3 nually, that the information displayed on 4 the application store page with respect to 5 the application, including primary country 6 of origin and beneficial ownership, is up-to- 7 date. 8 (ii) VIOLATIONS.—If a developer vio- 9 lates clause (i)— 10 (I) the covered company shall 11 issue the developer a series of not 12 fewer than 3 warnings over a period 13 of not more than 90 days; and 14 (II) if the developer does not cor- 15 rect the violation by the date that is 16 90 days after the date on which the 17 first warning is issued under sub- 18 clause (I), the covered company shall 19 remove the application of the devel- 20 oper from the application store. 21 (4) REPORTING MECHANISM.—The Assistant 22 Secretary shall require a covered company to estab- 23 lish a mechanism that— 24 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 10 •S 1732 IS (A) allows a user of the covered company’s 1 application store, an employee of a developer 2 whose application is distributed through the 3 covered company’s application store, or an asso- 4 ciated third party to report a potential violation 5 of this subsection by a developer, including in- 6 correct information displayed on the application 7 store page; and 8 (B) allows a report under subparagraph 9 (A) to be made anonymously. 10 (5) WRITTEN POLICY FOR APPEALS OF REMOV- 11 ALS.—The Assistant Secretary shall require a cov- 12 ered company to establish, for any application store 13 owned, controlled, or operated by the covered com- 14 pany, a clear written policy for how a developer can 15 appeal the removal of an application from the appli- 16 cation store and have the application be reinstated. 17 SEC. 4. LIST OF FOREIGN COUNTRIES WITH NATIONAL 18 LAWS RESULTING IN GOVERNMENT CON- 19 TROL OVER APPLICATIONS. 20 (a) IN GENERAL.—Not later than 180 days after the 21 date of enactment of this Act, and annually thereafter, 22 the Secretary of the Treasury and the Secretary of Com- 23 merce shall jointly develop and submit to Congress a list 24 of each foreign country that has in effect a national law 25 VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS 11 •S 1732 IS that may subject a developer or application to control by 1 the government of the country over content moderation, 2 algorithm design, or user data transfers. 3 (b) PUBLICATION.—With respect to the list developed 4 under subsection (a)— 5 (1) the Secretary of the Treasury shall make 6 the list publicly available on the website of the De- 7 partment of the Treasury; and 8 (2) the Secretary of Commerce shall make the 9 list publicly available on the website of the Depart- 10 ment of Commerce. 11 SEC. 5. LIMITATION OF ENFORCEMENT AND REGULATION. 12 The Assistant Secretary may not exercise any en- 13 forcement authority or regulatory authority over a covered 14 company or developer that is not provided under this Act, 15 including through rulemaking. 16 SEC. 6. ENFORCEMENT. 17 The Attorney General may bring a civil action in an 18 appropriate district court of the United States against any 19 covered company that violates this Act. 20 Æ VerDate Sep 11 2014 05:06 Jun 02, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6301 E:\BILLS\S1732.IS S1732 kjohnson on DSK79L0C42PROD with BILLS