```

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 5339 Introduced in Senate (IS)]

<DOC>

117th CONGRESS
  2d Session
                                S. 5339

To support research about the impact of digital communication platforms 
    on society by providing privacy-protected, secure pathways for 
     independent research on data held by large internet companies.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           December 21, 2022

 Mr. Coons (for himself, Mr. Portman, Ms. Klobuchar, and Mr. Cassidy) 
introduced the following bill; which was read twice and referred to the 
          Committee on Health, Education, Labor, and Pensions

_______________________________________________________________________

                                 A BILL

 
To support research about the impact of digital communication platforms 
    on society by providing privacy-protected, secure pathways for 
     independent research on data held by large internet companies.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Platform 
Accountability and Transparency Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Qualified research projects, qualified researchers, and 
                            qualified data and information.
Sec. 4. Obligations and immunity for platforms.
Sec. 5. Obligations and immunity for qualified researchers.
Sec. 6. Reporting.
Sec. 7. Enforcement.
Sec. 8. Amendment to the Communications Decency Act.
Sec. 9. Establishing a safe harbor for research on social media 
                            platforms.
Sec. 10. Rulemaking authority.
Sec. 11. Authorization of appropriations.
Sec. 12. Severability.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Chair.--The term ``Chair'' means the Chair of the 
        Federal Trade Commission.
            (3) NSF.--The term ``NSF'' means the National Science 
        Foundation.
            (4) Personal information.--The term ``personal 
        information'' means any information, regardless of how the 
        information is collected, inferred, or obtained that is linked 
        or reasonably linkable to a specific consumer or consumer 
        device.
            (5) Platform.--The term ``platform'' means any entity 
        subject to the jurisdiction of the Federal Trade Commission 
        under section 5(a)(2) of the Federal Trade Commission Act (15 
        U.S.C. 45(a)(2)) that--
                    (A) operates a website, desktop application, 
                augmented or virtual reality application, or mobile 
                application that--
                            (i) permits a person to become a registered 
                        user, establish an account, or create a profile 
                        for the purpose of allowing the user to create, 
                        share, and view user-generated content through 
                        such an account or profile;
                            (ii) enables one or more users to generate 
                        content that can be viewed by other users of 
                        the platform; and
                            (iii) primarily serves as a medium for 
                        users to interact with content generated by 
                        other users of the platform and for the 
                        platform to deliver ads to users; and
                    (B) has at least 50,000,000 unique monthly users in 
                the United States for a majority of the months in the 
                most recent 12-month period.
            (6) Qualified data and information.--
                    (A) In general.--Subject to subparagraph (B), the 
                term ``qualified data and information'' means data and 
                information from a platform--
                            (i) that the NSF determines is necessary to 
                        allow a qualified researcher to carry out a 
                        qualified research project; and
                            (ii) that--
                                    (I) is feasible for the platform to 
                                provide;
                                    (II) is proportionate to the needs 
                                of the qualified researchers to 
                                complete the qualified research 
                                project;
                                    (III) will not cause the platform 
                                undue burden in providing the data and 
                                information to the qualified 
                                researcher; and
                                    (IV) would not be otherwise 
                                available to the qualified researcher.
                    (B) Exclusions.--Such term does not include any of 
                the following:
                            (i) Direct and private messages between 
                        users.
                            (ii) Biometric information, such as a 
                        fingerprint, voiceprint, eye retinas, irises, 
                        or other unique biological patterns or 
                        characteristics.
                            (iii) Precise geospatial information.
            (7) Qualified researcher.--
                    (A) In general.--Subject to subparagraph (B), the 
                term ``qualified researcher'' means a researcher 
                affiliated with a United States university or a United 
                States nonprofit organization (as described in section 
                501(c) of the Internal Revenue Code of 1986) that is 
                specifically identified in a research proposal that is 
                approved as a qualified research project pursuant to 
                section 3.
                    (B) Exclusion.--Such term does not include a 
                researcher who is affiliated with a Federal, State, 
                local, or tribal law enforcement or intelligence 
                agency.
            (8) Qualified research project.--The term ``qualified 
        research project'' means a research plan that has been approved 
        pursuant to section 3.
            (9) State.--The term ``State'' means each of the 50 States 
        of the United States, the District of Columbia, Puerto Rico, 
        the Virgin Islands, American Samoa, Guam, and the Northern 
        Mariana Islands.
            (10) User.--The term ``user'' means a person that uses a 
        platform for any purpose, including advertisers and sellers, 
        regardless of whether that person has an account or is 
        otherwise registered with the platform.

SEC. 3. QUALIFIED RESEARCH PROJECTS, QUALIFIED RESEARCHERS, AND 
              QUALIFIED DATA AND INFORMATION.

    (a) Establishment.--Not later than 1 year after the date of 
enactment of this Act, the NSF and the Commission shall jointly 
establish a research program to review research applications for 
approval as qualified research projects.
    (b) Research Program Requirements.--The research program 
established by the NSF and the Commission under this section shall--
            (1) provide that the NSF shall--
                    (A) establish a process to solicit research 
                applications in order to identify qualified research 
                projects;
                    (B) review research applications for scientific 
                merit;
                    (C) ensure research applications identify proposed 
                qualified researchers;
                    (D) publish guidelines and criteria to be used by 
                the NSF in determining how it will review research 
                applications seeking approval to be a qualified 
                research project;
                    (E) identify, in consultation with the Commission, 
                what data and information in a platform's possession 
                will be qualified data and information for the purposes 
                of carrying out a qualified research project;
                    (F) ensure that approved research applications do 
                not request data described in section 2(6)(B); and
                    (G) prescribe and publish guidelines and criteria, 
                in consultation with the Commission, used to determine 
                how the NSF and Commission will identify qualified data 
                and information necessary to conduct a qualified 
                research project;
            (2) provide that the Commission shall--
                    (A) review research applications for privacy and 
                cybersecurity risks;
                    (B) establish appropriate privacy and cybersecurity 
                safeguards that a platform must implement in the 
                provision of, and with which qualified researchers must 
                comply to access, qualified data and information that a 
                platform is required to share with qualified 
                researchers pursuant to a qualified research project, 
                and such safeguards--
                            (i) must account for the relative 
                        sensitivity of the qualified data and 
                        information involved and be sufficient to 
                        protect such data and information; and
                            (ii) may include alternative protections, 
                        as appropriate and in consideration of the aims 
                        of the qualified research project, including--
                                    (I) encryption of the data in 
                                transit and when not in use;
                                    (II) delivery of the data in a 
                                format that employs methods to prevent 
                                qualified researchers from identifying 
                                individuals in the dataset;
                                    (III) data access logs; and
                                    (IV) keystroke logs;
                    (C) in the case of each qualified research project, 
                consider whether to require the platform to provide a 
                secure physical or virtual environment to facilitate 
                delivery of the qualified data and information;
                    (D) establish appropriate privacy and cybersecurity 
                safeguards that a qualified researcher must implement 
                when receiving, storing, or analyzing qualified data 
                and information or generating new data using such 
                qualified data and information, including inferential 
                data based on such qualified data and information, and 
                such safeguards may include a requirement that a 
                qualified researcher delete qualified data and 
                information after completion of a qualified research 
                project, however any such safeguard must provide the 
                qualified researcher the ability to retain enough 
                information about the qualified data and information to 
                allow the researcher or their peers to recreate the 
                qualified research project upon request to, and 
                approval from, the NSF and Commission pursuant to this 
                section;
                    (E) publish a list of criteria for determining the 
                privacy and cybersecurity safeguards required for 
                qualified data and information related to a qualified 
                research project;
                    (F) provide platforms with the opportunity to 
                provide comment about the privacy and cybersecurity 
                safeguards required for a qualified research project;
                    (G) provide researchers with the opportunity to 
                provide comment about the privacy and cybersecurity 
                safeguards required for a qualified research project;
                    (H) establish a process to ensure that qualified 
                researchers will be able to comply with any such 
                privacy and cybersecurity safeguards; and
                    (I) publish a list of criteria for determining 
                whether qualified researchers will be able to comply 
                with any such privacy and cybersecurity safeguards;
            (3) provide that a research application may not be denied 
        on grounds of the race, color, age, sex, national origin, 
        political affiliation, or disability of the researcher;
            (4) provide that a research application shall not be 
        approved as a qualified research project unless it--
                    (A) has been approved by an institutional review 
                board;
                    (B) has been deemed exempt from institutional 
                review board review; or
                    (C) is excluded from the criteria for institutional 
                review board review;
            (5) provide a platform the opportunity to comment on and 
        appeal the approval of a qualified research project for which 
        the platform is required to provide qualified data and 
        information to the NSF and Commission on the grounds that--
                    (A) the platform cannot provide the qualified data 
                and information;
                    (B) providing access to the qualified data and 
                information would lead to significant vulnerabilities 
                in the security of the platform's service or user 
                privacy; or
                    (C) the privacy and cybersecurity safeguards 
                established by the Commission are not sufficient to 
                protect the qualified data and information; and
            (6) require that any analysis by a qualified researcher 
        derived from a qualified research project that the qualified 
        researcher intends to publish undergo prepublication review by 
        the Commission to ensure that the analysis does not expose 
        personal information, or trade secrets.
    (c) Qualified Researcher Capacity.--A qualified research project 
may not proceed unless the proposed qualified researchers can 
demonstrate that they have the capacity to comply with the privacy and 
cybersecurity safeguards established for the qualified research 
project.
    (d) Aim of Project.--A research application shall not be approved 
as a qualified research project unless it is in the public interest, 
aims to study activity on a platform, and is used for noncommercial 
purposes.
    (e) No Judicial Review.--A determination by the Commission and the 
NSF under this section regarding whether a research application will be 
deemed a qualified research project shall not be subject to judicial 
review.
    (f) No Government Access.--If a platform provides qualified data 
and information to a qualified researcher, no government entity may 
seek access to such qualified data and information from the qualified 
researcher.
    (g) Researcher Consortia.--The Commission and NSF shall establish 
procedures and necessary safeguards under this section that allow for 
consortia of researchers to apply to seek data for the purpose of 
conducting a series of qualified research projects.

SEC. 4. OBLIGATIONS AND IMMUNITY FOR PLATFORMS.

    (a) Provision of Qualified Data and Information.--A platform shall 
provide access to qualified data and information relating to a 
qualified research project to a qualified researcher under the terms 
and privacy and cybersecurity safeguards dictated by the Commission for 
the purpose of carrying out the qualified research project.
    (b) Continued Access to Qualified Data and Information.--
            (1) In general.--A platform may not restrict or terminate a 
        qualified researcher's access to qualified data and information 
        for an ongoing qualified research project unless the platform 
        has a reasonable belief that the qualified researcher is not 
        acting in accordance with the cybersecurity and privacy 
        safeguards required for the qualified research project.
            (2) Notice and review of change to access.--If a platform 
        restricts or terminates a qualified researcher's access to 
        qualified data and information for an ongoing qualified 
        research project--
                    (A) the platform shall, within a reasonable time 
                (as established by the Commission), inform the 
                Commission in writing that the platform has restricted 
                or terminated the qualified researcher's access to the 
                qualified data and information; and
                    (B) the Commission shall promptly review the 
                platform's decision and determine whether the qualified 
                researcher has violated the privacy and cybersecurity 
                safeguards established for the qualified research 
                project.
    (c) Notice to Platform Users.--The Commission shall issue 
regulations requiring that platforms, through posting of notices or 
other appropriate means, keep users informed of their privacy 
protections and the information that the platform is required to share 
with qualified researchers under this Act.
    (d) Safe Harbor.--No cause of action under State or Federal law 
arising solely from the release of qualified data and information to 
qualified researchers in furtherance of a qualified research project 
may be brought against any platform that complies with the Act.
    (e) Right of Review.--If a platform fails to provide all of the 
qualified data and information required under the terms of a qualified 
research project to the qualified researcher conducting the project, 
the qualified researcher or the researcher's affiliated university or 
nonprofit organization may bring an action in district court for 
injunctive relief or petition the Commission to bring an enforcement 
action against the platform.
    (f) Security.--Nothing in this Act shall be construed to restrict a 
platform's ability to:
            (1) Take immediate steps to protect an interest that is 
        essential for the life or physical safety of a natural person.
            (2) Respond to security incidents, identity theft, fraud, 
        harassment, malicious or deceptive activities, or illegal 
        activity, preserve the integrity of security of systems, or 
        investigate or report those responsible for such actions.

SEC. 5. OBLIGATIONS AND IMMUNITY FOR QUALIFIED RESEARCHERS.

    (a) Scope of Permitted Use of Qualified Data and Information.--Each 
qualified researcher who accesses qualified data and information shall 
use the qualified data and information--
            (1) only for the purposes of conducting research authorized 
        under the terms of the qualified research project involved; and
            (2) in accordance with the privacy and cybersecurity 
        safeguards prescribed by the Commission for the qualified 
        research project.
    (b) Protection of Personal Information.--A qualified researcher 
that is provided access to qualified data and information for purposes 
of a qualified research project may not--
            (1) attempt to reidentify, disclose, publish, or use for 
        commercial purpose personal information derived from such 
        qualified data and information; or
            (2) disclose such qualified data and information to a third 
        party for any reason.
    (c) Effect of Violation of Information and Privacy Standards.--
Qualified researchers who intentionally, recklessly, or negligently 
violate the privacy and cybersecurity safeguards prescribed by the 
Commission for a qualified research project may be subject to both 
civil and criminal enforcement, under applicable Federal, State, and 
local laws. The Commission may refer any such violation to the 
Department of Justice or the appropriate State law enforcement agency.

SEC. 6. REPORTING.

    Not later than 24 months after the date of enactment of this Act, 
and annually thereafter, the NSF and the Commission shall submit to the 
Congress a joint report regarding the operation of this Act, which 
shall include a detailed statement of all qualified research projects, 
including with respect to each such project:
            (1) The identity of any authorized qualified researcher and 
        the institution the researcher is affiliated with.
            (2) The platforms required to provide qualified data and 
        information to qualified researchers.
            (3) The categories of qualified data and information each 
        platform was required to provide.
            (4) The terms of the privacy and cybersecurity safeguards 
        prescribed by the Commission to ensure the security of the 
        qualified data and information.
            (5) Any recommendations for improvements to the operation 
        of this Act in order to facilitate its aim of providing 
        enhanced platform transparency.

SEC. 7. ENFORCEMENT.

    (a) Unfair or Deceptive Act or Practice.--
            (1) In general.--A platform's failure to comply with 
        subsection (a) or (b) of section 4, or a qualified researcher's 
        failure to comply with subsection (a) or (b) of section 5, 
        shall be treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of the commission.--
                    (A) In general.--The Commission shall enforce the 
                provisions of this Act specified in paragraph (1) in 
                the same manner, by the same means, and with the same 
                jurisdiction, powers, and duties as though all 
                applicable terms and provisions of the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.) were incorporated 
                into and made a part of this section.
                    (B) Privileges and immunities.--Any person that 
                violates the provisions of this Act specified in 
                paragraph (1) shall be subject to the penalties, and 
                entitled to the privileges and immunities, provided in 
                the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).
    (b) Regulations.--The Commission shall have the authority to 
promulgate, in the manner prescribed by 5 U.S.C. 553, such rules and 
regulations as it may deem necessary to carry out its responsibilities 
under this Act.
    (c) Civil Enforcement Authority.--Whenever the Commission shall 
have reason to believe that a platform or qualified researcher has been 
or is in violation of any provision of this Act, the Commission may 
commence a civil action in a district court of the United States for an 
injunction against the platform or qualified researcher. Remedies in an 
injunctive action brought by the Commission are limited to an order 
enjoining, restraining, or preventing any act or practice that 
constitutes a violation of this Act and imposing a civil penalty of up 
to $10,000 for each violation, which shall accrue to the United States 
and may be recovered in a civil action brought by the Attorney General 
of the United States. Such penalty shall be in addition to other 
penalties as may be prescribed by law.
    (d) Attorney's Fees and Other Costs.--In the event any enforcement 
action is appealed, the prevailing party in the action may, in the 
discretion of the court, recover the costs of the action including 
reasonable investigative costs and attorneys' fees.

SEC. 8. AMENDMENT TO THE COMMUNICATIONS DECENCY ACT.

     Section 230(c)(1) of the Communications Act of 1934 (47 U.S.C. 
230(c)(1)) is amended--
            (1) by striking ``No provider or user'' and inserting the 
        following:
                    ``(A) In general.--Except as provided in 
                subparagraph (B), no provider or user''; and
            (2) by adding at the end the following:
                    ``(B) Data access and transparency compliance.--
                            ``(i) Definitions.--In this subparagraph, 
                        the terms `platform', `qualified data and 
                        information', `qualified researcher', and 
                        `qualified research project' have the meanings 
                        given those terms in section 2 of the Platform 
                        Accountability and Transparency Act.
                            ``(ii) Exception to immunity.--Subparagraph 
                        (A) shall not apply with respect to a claim 
                        against a provider of an interactive computer 
                        service in a civil action if--
                                    ``(I) the provider is a platform 
                                that has been determined by a final 
                                order of the Federal Trade Commission 
                                or a Federal court to have failed to 
                                provide qualified data and information 
                                pursuant to a qualified research 
                                project, in violation of section 6(a) 
                                of the Platform Accountability and 
                                Transparency Act; and
                                    ``(II) this failure to comply was a 
                                direct and substantial contributor to 
                                the harm alleged by the claimant that 
                                is the basis for the claim to 
                                relief.''.

SEC. 9. ESTABLISHING A SAFE HARBOR FOR RESEARCH ON SOCIAL MEDIA 
              PLATFORMS.

    (a) In General.--No civil claim will lie, nor will any criminal 
liability accrue, against any person for collecting covered information 
as part of a news-gathering or research project on a platform, so long 
as--
            (1) the information is collected through a covered method 
        of digital investigation;
            (2) the purpose of the project is to inform the general 
        public about matters of public concern;
            (3) with respect to information that is collected through a 
        covered method of digital investigation--
                    (A) the information is not used except to inform 
                the general public about matters of public concern; and
                    (B) the person takes reasonable measures to protect 
                the privacy of the platform's users;
            (4) with respect to the creation and use of a research 
        account, the person takes reasonable measures to avoid 
        misleading the platform's users; and
            (5) the project does not materially burden the technical 
        operation of the platform.
    (b) Regulations.--No later than 1 year after the date of the 
enactment of this Act, the Commission shall promulgate regulations 
under section 553 of title 5--
            (1) defining ``covered method of digital investigation,'' 
        which phrase, as defined, must encompass--
                    (A) the collection of data from a platform's user-
                facing interface through automated means;
                    (B) the collection of data donated by a user, 
                including through a browser extension or plug-in, where 
                the donation is in connection with the project and with 
                the user's explicit consent; and
                    (C) the creation or use of research accounts;
            (2) defining ``covered information,'' which phrase, as 
        defined, must encompass--
                    (A) publicly available information, except that 
                such term should not exclude data merely because an 
                individual must log into an account in order to see it;
                    (B) information about ads shown on the platform, 
                including the ads themselves, the advertiser's name and 
                disclosure string, and information the platform 
                provides to users about how an ad was targeted; and
                    (C) any other category of information the 
                collection of which the Commission determines, 
                consistent with paragraph (3), will not unduly burden 
                user privacy;
            (3) defining ``reasonable measures to protect the privacy 
        of the platform's users'' under subsection (a)(3), including by 
        specifying the measures that must be taken to--
                    (A) avoid the collection and retention of non-
                public information that would readily identify a user 
                without that user's consent;
                    (B) prevent the theft and accidental disclosure of 
                any data collected;
                    (C) ensure that the data at issue is not used for 
                any purpose other than to inform the general public 
                about matters of public concern; and
                    (D) restrict the publication or other disclosure of 
                any data that would readily identify a user without the 
                user's consent, except when such user is--
                            (i) an advertiser and the data concerns an 
                        advertisement; or
                            (ii) a public official, candidate for 
                        public office, or public figure;
            (4) defining ``reasonable measures to avoid misleading the 
        platform's users'' under subsection (a)(4); and
            (5) defining ``materially burden the technical operation of 
        a platform'' under subsection (a)(5).
    (c) Amendment of Regulations.--The Commission may, as necessary, in 
consultation with relevant stakeholders, amend regulations promulgated 
pursuant to subsection (b) to the extent such amendment will accomplish 
the purposes of this section.
    (d) Reporting.--In December of each calendar year beginning with 
calendar year 2023, the Commission shall require each operator of any 
platform to submit an annual report to the Commission that addresses 
whether the measures prescribed under subsections (b)(3) and (b)(4) of 
this section are adequately protecting the platform's users.
    (e) Definition of Research Account.--For purposes of this section, 
the term ``research account'' means an account on a platform that is 
created and used solely for the purposes of a news-gathering or 
research project that meets the requirements of subsection (a) and for 
no longer than is necessary to complete such project.

SEC. 10. RULEMAKING AUTHORITY.

    (a) Additional Reporting Requirements.--
            (1) In general.--In consultation with the NSF, the 
        Commission may, in accordance with section 553 of title 5, 
        United States Code, and subject to subsection (g), issue 
        regulations that require platforms to make available to 
        qualified researchers data, metrics, or other information that 
        the Commission determines will facilitate independent research 
        in the public interest into activity on platforms.
            (2) Factors.--In exercising its authority under this 
        subsection, the Commission shall consider the extent to which 
        disclosures under this subsection may facilitate collaboration 
        amongst qualified researchers and alleviate burdens on 
        platforms and qualified researchers as compared to qualified 
        research projects conducted pursuant to section 3.
            (3) Form and frequency; retention of information.--The 
        Commission shall specify in the regulations the required form 
        and frequency of reporting or disclosures, as well as how long 
        information should be retained and made available. It may 
        require the information be provided in a form that is 
        accessible for analysis by qualified researchers, such as 
        through an application programming interface.
            (4) Consultation.--The Commission shall further consult 
        with the National Institutes of Health and other relevant 
        government agencies, as appropriate, in exercising its 
        authority under this subsection.
            (5) Applicability of prior sections.--The Commission shall 
        establish privacy and cybersecurity safeguards applicable to 
        platforms and qualified researchers for data made available to 
        qualified researchers under this section in the manner 
        described in section 3 for data made available under that 
        section. The obligations and immunities for platforms and 
        qualified researchers described in sections 4 and 5 shall apply 
        to data disclosed to qualified researchers under this section, 
        and the provisions of section 7 may be invoked to enforce this 
        section.
    (b) Transparency of Certain Content and User Accounts.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall, in accordance with 
        section 553 of title 5, United States Code, and subject to 
        subsection (g), issue regulations to require platforms to make 
        available to the public on an ongoing basis, in a specific 
        section of their online interface, through a searchable and 
        reliable tool that allows multicriteria queries and through 
        application programming interfaces, a repository containing 
        information regarding reasonably public content on the platform 
        that--
                    (A) has been highly disseminated; or
                    (B) was originated or spread by major public 
                accounts.
            (2) Disclosure of public content samplings.--The 
        regulations issued under paragraph (1) shall further require 
        platforms to disclose on an ongoing basis statistically 
        representative samplings of reasonably public content, 
        including, at a minimum, a sampling that is weighted by the 
        number of impressions the content receives.
            (3) Required information.--The information required to be 
        disclosed about content described in paragraphs (1) and (2) 
        shall include, as appropriate--
                    (A) the user-generated content itself, including 
                any text, images, videos, links, and keywords;
                    (B) platform-generated content displayed in 
                connection with the user-generated content, including 
                any dates, labels, disclaimers, or metrics;
                    (C) metrics about the extent of dissemination of or 
                engagement with the content, including the number of 
                impressions, reach, and engagements;
                    (D) information about the extent to which the 
                content was recommended, amplified, or restricted by 
                platform algorithms or policies;
                    (E) reasonably public information about the user 
                accounts responsible for the content; and
                    (F) public uniform resource locators that uniquely 
                link to the content and identify related materials such 
                as the parent content, replying content, and cross-
                posted content.
            (4) Highly disseminated content.--As part of the 
        regulations issued under paragraph (1), the Commission shall 
        define ``highly disseminated'' according to metrics that the 
        Commission deems appropriate (which may include engagement, 
        views, reach, impressions, or other metrics), provided that a 
        piece of content must have been viewed by at least 10,000 
        unique users to qualify.
            (5) Major public accounts.--As part of the regulations 
        issued under paragraph (1), the Commission shall define ``major 
        public accounts'' as it deems appropriate, provided that, at a 
        minimum, ``major public accounts'' are restricted to reasonably 
        public accounts whose content is followed by at least 25,000 
        users or otherwise regularly reaches at least 25,000 users per 
        month.
            (6) Treatment of content that has been removed.--The 
        regulations described in paragraph (1) shall provide guidance 
        regarding disclosure of content that is removed by the user or 
        platform subsequent to its dissemination.
            (7) Frequency.--To the extent practicable, the Commission 
        shall require this information to be updated so as to provide a 
        real-time understanding of the content described in paragraphs 
        (1) and (2).
    (c) Transparency of Advertising.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall, in accordance with 
        section 553 of title 5, United States Code, and subject to 
        subsection (g), issue regulations to require platforms to 
        disclose on an ongoing basis information regarding advertising 
        on the platform. These regulations shall require platforms to 
        compile and disclose publicly in a specific section of their 
        online interface, through a searchable and reliable tool that 
        allows multicriteria queries and through application 
        programming interfaces, a repository containing the information 
        referred to in paragraph (2), for the entire period during 
        which they present an advertisement and until one year after 
        the advertisement was presented for the last time on their 
        online interfaces. Platforms shall ensure that the repository 
        does not contain any personal data of the recipients of the 
        service to whom the advertisement was or could have been 
        presented.
            (2) Information required.--The information required to be 
        included in the repository required under paragraph (1) shall 
        include at least all of the following information:
                    (A) The content of the advertisement, including the 
                name of the product, service or brand and the subject 
                matter of the advertisement.
                    (B) The natural or legal person on whose behalf the 
                advertisement is presented.
                    (C) The natural or legal person who paid for the 
                advertisement, if that person is different from the 
                person referred to in subparagraph (B).
                    (D) The period during which the advertisement was 
                presented.
                    (E) Whether the advertisement was intended to be 
                presented specifically to one or more particular groups 
                of recipients of the service and if so, the main 
                parameters used for that purpose including where 
                applicable the main parameters used to exclude one or 
                more of such particular groups.
                    (F) The total number of recipients of the service 
                reached and, where applicable, aggregate numbers broken 
                down by group or groups of recipients that the 
                advertisement specifically targeted.
                    (G) Information about the extent to which the 
                advertisement was recommended, amplified, or restricted 
                by platform algorithms or policies.
            (3) Treatment of removed ads.--The regulations described in 
        paragraph (1) shall provide guidance regarding disclosure of 
        ads that are removed by the user or platform subsequent to its 
        dissemination.
            (4) Frequency.--To the extent practicable, the Commission 
        shall require this information to be updated so as to provide a 
        real-time understanding of the content described in paragraph 
        (2).
    (d) Transparency of Algorithms and Company Metrics and Data.--
            (1) In general.--Not later than 1 year after enactment of 
        this Act, the Commission shall, in accordance with section 553 
        of title 5, United States Code, and subject to subsection (g), 
        issue regulations to require platforms to report publicly on 
        their use of recommender or ranking algorithms and metrics.
            (2) Required information.--The reporting required under 
        paragraph (1) shall be at least semiannual and include, as 
        appropriate--
                    (A) a description of all consumer-facing product 
                features that made use of recommender or ranking 
                algorithms during the reporting period;
                    (B) a summary of signals used as inputs to the 
                described recommender or ranking algorithms, including 
                an explanation of which rely on user data, an 
                explanation of the types of user data relied upon, and 
                ranked based on the significance of their impact on the 
                algorithms' outputs;
                    (C) a summary of the processes or predictions used 
                by the platform to assess the signals incorporated into 
                the recommender or ranking algorithm and to score or 
                rank content (such as predictions of future user 
                engagement), ranked based on the significance of their 
                impact on the algorithms' outputs;
                    (D) a summary of the optimization objectives of the 
                described recommender or ranking algorithms;
                    (E) a summary of metrics calculated by the platform 
                to assess product changes or new features, or as a 
                basis to assess performance or calculate employee or 
                executive compensation, with an assessment of their 
                relative importance in company decision making;
                    (F) significant changes during the reporting period 
                from the last report; and
                    (G) other information about the recommender or 
                ranking algorithms that the Commission deems 
                appropriate.
            (3) Implementation.--In implementing this section, the 
        Commission shall ensure that the reporting is useful and 
        actionable while ensuring that platforms are not required to 
        disclose trade secrets.
    (e) Transparency of Content Moderation and Violating Content.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall, in accordance with 
        section 553 of title 5, United States Code, and subject to 
        subsection (g), issue regulations to require platforms to 
        report on an ongoing basis information regarding content 
        moderation and content violating platform policies.
            (2) Required information.--The information required to be 
        disclosed under paragraph (1) shall include, as appropriate--
                    (A) statistics regarding the amount of content that 
                the platform determined violated its policies, broken 
                down by--
                            (i) the violated policy;
                            (ii) the action taken in response to the 
                        violation;
                            (iii) the methods the platform used to 
                        identify the violating content (such as 
                        artificial intelligence, user report, human 
                        moderator review, or other means);
                            (iv) the extent to which the content was 
                        recommended, amplified, or restricted by 
                        platform algorithms or policies; and
                            (v) geographic and demographic factors as 
                        the Commission deems appropriate;
                    (B) statistics regarding the number of times 
                violating content was viewed by users and the number of 
                users who viewed it;
                    (C) estimates by the platform about the prevalence 
                of violating content (including as measured by the 
                number of impressions of violating content), broken 
                down by--
                            (i) the violated policy;
                            (ii) geographic and demographic factors; 
                        and
                            (iii) other factors the Commission deems 
                        appropriate; and
                    (D) the number of orders received from governmental 
                authorities, categorized by the type of illegal content 
                concerned, and the average time needed for taking the 
                action specified in those orders.
    (f) Data Dictionaries.--Not later than 1 year after the date of 
enactment of this Act, the Commission shall, in accordance with section 
553 of title 5, United States Code, and subject to subsection (g), 
issue regulations to require platforms to disclose, and update 
periodically, data dictionaries to inform and facilitate researcher 
data access requests. Such data dictionaries shall include descriptions 
of significant datasets in the platform's possession relating to 
content on, or users of, the platform, enforcement of content policy, 
or advertising, as necessary or appropriate to inform and facilitate 
researcher data access requests.
    (g) Privacy, Confidentiality, and Platform Integrity.--The 
Commission shall ensure that any reporting or disclosures required 
pursuant to this section do not infringe upon reasonable expectations 
of personal privacy of users of platforms or of other persons, or 
require dissemination of trade secrets. If necessary, the Commission 
may require withholding of information otherwise required to be 
disclosed to meet this requirement. The Commission shall further 
consider the effect of disclosures on risks to platform integrity or 
the susceptibility of the platform to manipulation or inauthentic 
behavior, and may limit or reduce the information required to be 
disclosed if necessary to address a substantial such risk.
    (h) Variation.--In implementing this section, the Commission may 
vary the requirements it imposes on platforms based on the size of the 
platform and scope of its services.
    (i) Definitions.--In this section:
            (1) Engagement.--The term ``engagement'' means, with 
        respect to content on a platform, the number of times a user 
        interacts with the content, whether through comments, 
        indications of approval or disapproval (such as likes or 
        dislikes), reshares, or any other form of active interaction.
            (2) Impression.--The term ``impression'' means, with 
        respect to content on a platform, the display or delivery of 
        the content to a user, regardless of whether the user engages 
        with the content.
            (3) Prevalence of violating content.--The term ``prevalence 
        of violating content'' means a platform's estimate of the 
        number of impressions of violating content among its users, 
        regardless of whether the platform ever identifies that 
        particular content as violating.
            (4) Reach.--The term ``reach'' means, with respect to 
        content on a platform, the number of users to whom the content 
        is displayed or delivered during a particular period, 
        regardless of how many times it is delivered to them.
            (5) Real-time understanding.--The term ``real-time 
        understanding'' means an understanding of content on a platform 
        that is up to date within less than 24 hours.
            (6) Reasonably public.--The term ``reasonably public'' 
        means information that the author made available in a manner 
        and under such circumstances such that the author does not 
        retain a reasonable expectation of privacy in the information. 
        The fact that a user may need to register or create an account 
        with a platform to view information does not preclude it from 
        being deemed reasonably public.
            (7) Recommender or ranking algorithm.--The term 
        ``recommender or ranking algorithm'' means a fully or partially 
        automated system used by a platform to suggest in its online 
        interface specific information to recipients of the service 
        offered by the platform, or to prioritize that information, 
        including as a result of a search initiated by the recipient of 
        the service or otherwise determining the relative order or 
        prominence of information displayed. This includes any 
        computational process, including one derived from machine 
        learning or other artificial intelligence techniques, that 
        processes personal information or other data for the purpose of 
        determining the order or manner that a set of information is 
        provided, recommended to, or withheld from a user of a 
        platform, including the provision of commercial content, the 
        display of social media posts, recommendations of user or group 
        accounts to follow or associate with, or any other method of 
        content selection, amplification, or restriction.

SEC. 11. AUTHORIZATION OF APPROPRIATIONS.

    There are authorized to be appropriated to the NSF and the 
Commission such sums as are necessary to carry out this Act for fiscal 
year 2022 and each succeeding fiscal year.

SEC. 12. SEVERABILITY.

    If any provision of this Act, or the application of such provision 
to any person or circumstance, is held to be unconstitutional, the 
remainder of this Act, and the application of the remaining provisions 
of this Act, to any person or circumstance, shall not be affected.
                                 <all>
```