II 

116TH CONGRESS 

2D SESSION S. 4869 

To require software marketplace operators and owners of covered foreign 

software to provide consumers with a warning prior to the download 

of such software, to establish consumer data protections, and for other 

purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 26 (legislative day, OCTOBER 19), 2020 

Mr. RUBIO introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To require software marketplace operators and owners of 

covered foreign software to provide consumers with a 

warning prior to the download of such software, to establish consumer data protections, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Adversarial Platform 

5 Prevention Act of 2020’’ or the ‘‘APP Act’’. 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•S 4869 IS

1 SEC. 2. CONSUMER PROTECTIONS REGARDING COVERED 

2 FOREIGN SOFTWARE. 

3 (a) CONSUMER WARNING AND ACKNOWLEDGMENT

4 FOR DOWNLOAD OF COVERED FOREIGN SOFTWARE.— 

5 (1) IN GENERAL.—A software marketplace op6 erator or an owner of covered foreign software may 

7 not: 

8 (A) Permit a consumer to download cov9 ered foreign software unless, before the 

10 download begins— 

11 (i) a warning that meets the require12 ments of paragraph (2) is displayed to the 

13 consumer, separately from any privacy pol14 icy, terms of service, or other notice; and 

15 (ii) the consumer is required to choose 

16 (by taking an affirmative step such as 

17 clicking on a button) between the options 

18 of— 

19 (I) acknowledging such warning 

20 and proceeding with the download; or 

21 (II) cancelling the download. 

22 (B) Make available covered foreign soft23 ware for download by consumers unless the op24 erator or owner has in place procedures to en25 sure compliance with subparagraph (A). 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•S 4869 IS

1 (2) REQUIREMENTS FOR WARNING.—The re2 quirements of this paragraph are, with respect to a 

3 warning regarding covered foreign software— 

4 (A) that the warning include— 

5 (i) the name of the covered foreign 

6 software; 

7 (ii) the name of each owner of the 

8 covered foreign software, and, if applicable 

9 with respect to each such owner, the name 

10 of the covered country— 

11 (I) under the laws of which such 

12 owner is organized; 

13 (II) in which such owner con14 ducts its principal operations; or 

15 (III) in which such owner is 

16 headquartered; 

17 (iii) the name of each controlling enti18 ty of the owner of the covered foreign soft19 ware, and if applicable with respect to each 

20 such controlling entity, the name of the 

21 covered country— 

22 (I) under the laws of which such 

23 entity is organized; 

24 (II) in which such entity con25 ducts its principal operations; or 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•S 4869 IS

1 (III) in which such entity is 

2 headquartered; 

3 (iv) any enumerated risk to data pri4 vacy and security or the censorship of 

5 speech associated with the laws and prac6 tices of a covered country disclosed under 

7 this subparagraph; 

8 (v) whether the owner of a covered 

9 foreign software, or any controlling entity 

10 of such owner, has ever provided the data 

11 of United States consumers, as it relates to 

12 such software, to any law enforcement 

13 agency, intelligence agency, or other gov14 ernment entity of a covered country; and 

15 (vi) a description of how to acknowl16 edge the warning and either proceed with 

17 or cancel the download; 

18 (B) that the warning be updated annually; 

19 and 

20 (C) such other requirements as the Com21 mission, in consultation with the Attorney Gen22 eral of the United States, shall determine. 

23 (3) LIABILITY OF SOFTWARE OWNER.—If a 

24 software marketplace operator permits a consumer 

25 to download covered foreign software or makes covVerDate Sep 11 2014 00:48 Nov 06, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S4869.IS S4869

pamtmann on DSKBC07HB2PROD with BILLS
5 

•S 4869 IS

1 ered foreign software available for download in viola2 tion of paragraph (1), the operator shall not be lia3 ble for a violation of such paragraph if the operator 

4 reasonably relied on inaccurate information from the 

5 owner of the covered foreign software in determining 

6 that the software was not covered foreign software, 

7 and the owner of the covered foreign software shall 

8 be considered to have committed the violation of 

9 such paragraph. 

10 (b) CONSUMER DATA PROTECTIONS.— 

11 (1) CONSUMER DATA PRIVACY PRACTICES.— 

12 (A) CONSUMER DATA REPORT.—Not later 

13 than 30 days after the date of enactment of 

14 this Act (or in the case of covered foreign soft15 ware that is created after such date or software 

16 that becomes covered foreign software after 

17 such date, 60 days after the date that such 

18 software is created or becomes covered foreign 

19 software), and annually thereafter, an owner of 

20 covered foreign software shall submit to the 

21 Commission and the Attorney General of the 

22 United States a report that includes a complete 

23 description of any consumer data privacy prac24 tice of the owner as it relates to the data of 

25 United States consumers, including— 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•S 4869 IS

1 (i) the type of data of United States 

2 consumers being accessed; 

3 (ii) a description of how such data is 

4 used by the owner; 

5 (iii) a description of any consumer 

6 data protection measure in place that pro7 tects the rights and interests of United 

8 States consumers; 

9 (iv) information regarding— 

10 (I) the number of requests from 

11 a law enforcement agency, intelligence 

12 agency, or other government entity of 

13 a covered country to disclose the con14 sumer data of a person in the United 

15 States; and 

16 (II) a description of how such re17 quests were handled; and 

18 (v) a description of any internal con19 tent moderation practice of the owner as it 

20 relates to the data of consumers in the 

21 United States, including any such practice 

22 that also relates to consumers in another 

23 country. 

24 (B) PUBLIC ACCESSIBILITY.—Notwith25 standing any other provision of law, not later 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•S 4869 IS

1 than 60 days after the receipt of a report under 

2 subparagraph (A), the Attorney General of the 

3 United States shall publish the information con4 tained in such report (except for any confiden5 tial material) in a publicly accessible manner. 

6 (2) CONSUMER DATA DISCLOSURE PRAC7 TICES.— 

8 (A) EFFECT OF DISCLOSURE AND CENSOR9 SHIP.—An owner of covered foreign software 

10 may not collect or store data of United States 

11 consumers, as it relates to such covered foreign 

12 software, if such owner complies with any re13 quest from a law enforcement agency, intel14 ligence agency, or other government entity of a 

15 covered country— 

16 (i) to disclose the consumer data of a 

17 person in the United States; or 

18 (ii) to censor the online activity of a 

19 person in the United States. 

20 (B) REPORT TO FEDERAL TRADE COMMIS21 SION AND ATTORNEY GENERAL OF THE UNITED

22 STATES.—Not later than 14 days after receiv23 ing a request described in subparagraph (A), an 

24 owner of covered foreign software shall submit 

25 to the Commission and the Attorney General of 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•S 4869 IS

1 the United States a report that includes a de2 scription of such request. 

3 (C) ACCESS TO CONSUMER DATA IN SUB4 SIDIARIES.—Not later than 1 year after the 

5 date of enactment of this Act, the Commission, 

6 in consultation with the Attorney General of the 

7 United States, shall issue regulations to require 

8 an owner of covered foreign software to imple9 ment consumer data protection measures to en10 sure that any parent company in a covered 

11 country may not access the consumer data col12 lected and stored, or otherwise held, by a sub13 sidiary entity of such parent company in a 

14 country that is not a covered country. 

15 (3) PROHIBITIONS ON STORAGE, USE, AND

16 SHARING OF CONSUMER DATA.— 

17 (A) USE, TRANSFER, AND STORAGE OF

18 CONSUMER DATA.—With respect to the con19 sumer data of any person in the United States, 

20 an owner of covered foreign software may not— 

21 (i) use such data in a covered country; 

22 (ii) transfer such data to a covered 

23 country; or 

24 (iii) store such data outside of the 

25 United States. 


pamtmann on DSKBC07HB2PROD with BILLS
9 

•S 4869 IS

1 (B) SHARING OF CONSUMER DATA.—An 

2 owner of covered foreign software may not 

3 share with, sell to, or otherwise disclose to any 

4 other commercial entity the consumer data of 

5 any person in the United States. 

6 (4) CENSORSHIP REMEDY.—In the case where 

7 an owner of covered foreign software censors the on8 line activity of a person in the United States, such 

9 owner shall provide any affected user with a means 

10 to appeal such censorship. 

11 (c) NONAPPLICATION OF COMMUNICATIONS DE12 CENCY ACT PROTECTIONS.—Notwithstanding section 230 

13 of the Communications Act of 1934 (47 U.S.C. 230) (com14 monly known as the ‘‘Communications Decency Act’’), an 

15 owner of a covered foreign software shall not be considered 

16 a provider of an interactive computer service for purposes 

17 of subsection (c) of such section with respect to such cov18 ered foreign software. 

19 (d) ENFORCEMENT BY FEDERAL TRADE COMMIS20 SION.— 

21 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC22 TICES.—A violation of this section or a regulation 

23 promulgated under this section shall be treated as a 

24 violation of a regulation under section 18(a)(1)(B) 

25 of the Federal Trade Commission Act (15 U.S.C. 


pamtmann on DSKBC07HB2PROD with BILLS
10 

•S 4869 IS

1 57a(a)(1)(B)) regarding unfair or deceptive acts or 

2 practices. 

3 (2) POWERS OF COMMISSION.— 

4 (A) IN GENERAL.—The Commission shall 

5 enforce this section and the regulations promul6 gated under the section in the same manner, by 

7 the same means, and with the same jurisdic8 tion, powers, and duties as though all applicable 

9 terms and provisions of the Federal Trade 

10 Commission Act (15 U.S.C. 41 et seq.) were in11 corporated into and made a part of this Act. 

12 Any person who violates this section or a regu13 lation promulgated under this section shall be 

14 subject to the penalties and entitled to the 

15 privileges and immunities provided in the Fed16 eral Trade Commission Act. 

17 (B) ADDITIONAL RELIEF.—In addition to 

18 the penalties provided in the Federal Trade 

19 Commission Act (15 U.S.C. 41 et seq.), if a 

20 court or the Commission (in a formal adjudica21 tive proceeding) determines that an owner of 

22 covered foreign software violated this section or 

23 a regulation promulgated under this section, the 

24 court or the Commission shall prohibit the 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•S 4869 IS

1 owner from making such software available for 

2 sale or download in the United States. 

3 (3) REGULATIONS.—The Commission may pro4 mulgate regulations under section 553 of title 5, 

5 United States Code, to carry out this section. 

6 (4) SAVINGS CLAUSE.—Nothing in this section 

7 shall be construed to limit the authority of the Com8 mission under any other provision of law. 

9 (e) CRIMINAL OFFENSE.— 

10 (1) IN GENERAL.—A software marketplace op11 erator or an owner of covered foreign software that 

12 knowingly violates subsection (a) or (b) shall be 

13 fined $50,000 for each violation. 

14 (2) CLARIFICATIONS.— 

15 (A) SEPARATE VIOLATION.—For purposes 

16 of paragraph (1), each download by a consumer 

17 of a covered foreign software that does not 

18 meet the requirements of subparagraph (A) of 

19 subsection (a)(1) or is made available in viola20 tion of subparagraph (B) of such subsection 

21 shall be treated as a separate violation. 

22 (B) INDIVIDUAL OFFENSE.—An officer of 

23 a software marketplace operator or of an owner 

24 of covered foreign software who knowingly 

25 causes a violation of subsection (a)(1) with the 


pamtmann on DSKBC07HB2PROD with BILLS
12 

•S 4869 IS

1 intent to conceal the fact that the software is 

2 covered foreign software shall be fined under 

3 title 18, United States Code. 

4 (3) REFERRAL OF EVIDENCE BY FTC.—When5 ever the Commission obtains evidence that a soft6 ware marketplace operator or owner of covered for7 eign software has engaged in conduct that may con8 stitute a violation of subsection (a) or (b), the Com9 mission shall transmit such evidence to the Attorney 

10 General of the United States, who may institute 

11 criminal proceedings under this subsection. Nothing 

12 in this paragraph affects any other authority of the 

13 Commission to disclose information. 

14 (f) REPORT TO CONGRESS.—Not later than 1 year 

15 after the date of the enactment of this Act, the Commis16 sion, in consultation with the Attorney General of the 

17 United States, shall submit to Congress a report on the 

18 implementation and enforcement of this section. 

19 (g) EXPANSION OF COVERED TRANSACTIONS UNDER

20 THE DPA.—Section 721(a)(4)(B)(iii)(III) of the Defense 

21 Production Act of 1950 (50 U.S.C. 

22 4565(a)(4)(B)(iii)(III)) is amended by inserting ‘‘or com23 mercially available’’ after ‘‘sensitive’’. 

24 (h) EXPRESS PREEMPTION OF STATE LAW.—This 

25 Act shall supersede any provision of a law, regulation, or 


pamtmann on DSKBC07HB2PROD with BILLS
13 

•S 4869 IS

1 other requirement of any State or political subdivision of 

2 a State to the extent that such provision relates to the 

3 privacy or security of consumer data or the downloading 

4 of covered foreign software. 

5 (i) DEFINITIONS.—In this section: 

6 (1) CENSOR.— 

7 (A) IN GENERAL.—The term ‘‘censor’’, 

8 with respect to the online activity of a person 

9 in the United States, means— 

10 (i) to alter, delete, remove, or other11 wise make inaccessible user information 

12 without the consent of such user; or 

13 (ii) to alter, delete, remove, deny, pre14 vent, or otherwise prohibit user activity 

15 without the consent of such user. 

16 (B) EXCEPTION.—Such term shall not in17 clude any action by an owner of covered foreign 

18 software that is taken for the purpose of re19 stricting access to, or availability of, material 

20 that the owner considers to be obscene, lewd, 

21 lascivious, filthy, excessively violent, harassing, 

22 or otherwise objectionable, whether or not such 

23 material is constitutionally protected. 

24 (2) COMMISSION.—The term ‘‘Commission’’ 

25 means the Federal Trade Commission. 


pamtmann on DSKBC07HB2PROD with BILLS
14 

•S 4869 IS

1 (3) COVERED COUNTRY.— 

2 (A) IN GENERAL.—Subject to subpara3 graph (B), the term ‘‘covered country’’ 

4 means— 

5 (i) China, Russia, North Korea, Iran, 

6 Syria, Sudan, Venezuela, or Cuba; 

7 (ii) any other country the government 

8 of which the Secretary of State determines 

9 has provided support for international ter10 rorism pursuant to— 

11 (I) section 1754(c)(1)(A) of the 

12 Export Control Reform Act of 2018 

13 (50 U.S.C. 4318(c)(1)(A)); 

14 (II) section 620A of the Foreign 

15 Assistance Act of 1961 (22 U.S.C. 

16 2371); 

17 (III) section 40 of the Arms Ex18 port Control Act (22 U.S.C. 2780); or 

19 (IV) any other provision of law; 

20 and 

21 (iii) any other country designated by 

22 the Attorney General of the United States 

23 based on findings that such country’s con24 trol over potentially dangerous software 

25 poses an undue or unnecessary risk to the 


pamtmann on DSKBC07HB2PROD with BILLS
15 

•S 4869 IS

1 national security of the United States or to 

2 the safety and security of United States 

3 persons. 

4 (B) PROCESS.— 

5 (i) ADVANCE NOTICE TO CONGRESS.— 

6 The Attorney General of the United States 

7 shall not designate a country under sub8 paragraph (A)(iii) (or revoke such a des9 ignation under clause (iii)) unless the At10 torney General of the United States— 

11 (I) provides not less than 30 days 

12 notice prior to making such designa13 tion or revocation to— 

14 (aa) the Committee on En15 ergy and Commerce of the House 

16 of Representatives; 

17 (bb) the Permanent Select 

18 Committee on Intelligence of the 

19 House of Representatives; 

20 (cc) the Committee on Com21 merce, Science, and Transpor22 tation of the Senate; and 

23 (dd) the Select Committee 

24 on Intelligence of the Senate; and 


pamtmann on DSKBC07HB2PROD with BILLS
16 

•S 4869 IS

1 (II) upon request, provides an in2 person briefing to each such Com3 mittee during the 30-day notice pe4 riod. 

5 (ii) NOTICE AND PUBLICATION OF

6 DESIGNATION.—Upon designating a coun7 try under subparagraph (A)(iii), the Attor8 ney General of the United States shall 

9 transmit a notification of the designation 

10 to the Commission, and shall publish such 

11 notification. Such designation shall become 

12 effective on the day that is 60 days after 

13 the date on which such notification is 

14 transmitted and published. 

15 (iii) REVOCATION OF DESIGNATION.— 

16 The designation of a country under sub17 paragraph (A) may only be revoked by the 

18 Attorney General of the United States. 

19 (4) COVERED FOREIGN SOFTWARE.— 

20 (A) IN GENERAL.—The term ‘‘covered for21 eign software’’ means any of the following: 

22 (i) Software that is owned or directly 

23 or indirectly controlled by a person de24 scribed in subparagraph (B). 


pamtmann on DSKBC07HB2PROD with BILLS
17 

•S 4869 IS

1 (ii) Software that stores data of 

2 United States consumers in a covered 

3 country. 

4 (B) PERSONS DESCRIBED.—A person de5 scribed in this subparagraph is— 

6 (i) a person (other than an indi7 vidual)— 

8 (I) that is organized under the 

9 laws of a covered country; 

10 (II) the principal operations of 

11 which are conducted in a covered 

12 country; or 

13 (III) that is headquartered in a 

14 covered country; or 

15 (ii) a person (other than an indi16 vidual) that is, directly or indirectly, con17 trolled by a person described in clause (i). 

18 (5) MOBILE APPLICATION.—The term ‘‘mobile 

19 application’’ means a software program that runs on 

20 the operating system of a smartphone, tablet com21 puter, or similar mobile electronic device. 

22 (6) SOFTWARE.—The term ‘‘software’’ means 

23 any computer software program, including a mobile 

24 application. 


pamtmann on DSKBC07HB2PROD with BILLS
18 

•S 4869 IS

1 (7) SOFTWARE MARKETPLACE OPERATOR.— 

2 The term ‘‘software marketplace operator’’ means a 

3 person who, for a commercial purpose, operates an 

4 online store or marketplace through which software 

5 is made available for download by consumers in the 

6 United States. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS