II 

118TH CONGRESS 

1ST SESSION S. 2708 

To prohibit the use of exploitative and deceptive practices by large online 

operators and to promote transparency and consumer choice in the use 

of behavioral research by such providers. 

IN THE SENATE OF THE UNITED STATES 

JULY 27, 2023 

Mr. WARNER (for himself, Mrs. FISCHER, Ms. KLOBUCHAR, and Mr. THUNE) 

introduced the following bill; which was read twice and referred to the 

Committee on Commerce, Science, and Transportation 

A BILL 

To prohibit the use of exploitative and deceptive practices 

by large online operators and to promote transparency 

and consumer choice in the use of behavioral research 

by such providers. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Deceptive Experiences 

5 To Online Users Reduction Act’’ or the ‘‘DETOUR Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2708 IS

1 (1) AFFIRMATIVE EXPRESS CONSENT.—The 

2 term ‘‘affirmative express consent’’— 

3 (A) means an affirmative act by a user 

4 that— 

5 (i) clearly communicates the user’s 

6 authorization for a specific act or practice 

7 for which the user’s consent is sought to 

8 proceed; 

9 (ii) is freely taken by the user; and 

10 (iii) is taken after the user is in11 formed about the act or practice for which 

12 consent is sought, including through the 

13 presentation to the user of a clear and con14 spicuous description of the act or practice; 

15 and 

16 (B) does not include— 

17 (i) the consent of a child or teen; or 

18 (ii) the consent to a provision con19 tained in a general contract or service 

20 agreement. 

21 (2) AGGREGATED DATA.—The term ‘‘aggre22 gated data’’ means data that have been combined or 

23 collected together in summary or other form such 

24 that the data is not linked or reasonably linkable to 

25 any individual. 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2708 IS

1 (3) AUTO-PLAY.—The term ‘‘auto-play’’ means 

2 the automatic playing of content selected by a per3 sonalized recommendation system for a user. 

4 (4) CHILD.—The term ‘‘child’’ has the meaning 

5 given such term in section 1302 of the Children’s 

6 Online Privacy Protection Act of 1998 (15 U.S.C. 

7 6501). 

8 (5) COMMISSION.—The term ‘‘Commission’’ 

9 means the Federal Trade Commission. 

10 (6) COMPULSIVE USAGE.—The term ‘‘compul11 sive usage’’ means any response stimulated by exter12 nal factors that causes an individual to engage in re13 petitive behavior causing psychological distress, loss 

14 of control, anxiety, depression, or harmful stress re15 sponses. 

16 (7) COVERED RESEARCH.—The term ‘‘covered 

17 research’’ means behavioral or psychological experi18 mentation or research, including through human ex19 perimentation, of overt or observable user actions on 

20 online platforms, including interactions between and 

21 among individuals and the activities of social groups, 

22 that involves interventions that are designed by the 

23 experimenter or researcher to alter or manipulate 

24 the emotions of users. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2708 IS

1 (8) DE-IDENTIFIED DATA.—The term ‘‘de-iden2 tified data’’ means information that— 

3 (A) does not identify and is not linked or 

4 reasonably linkable to a distinct individual or a 

5 device, regardless of whether the information is 

6 aggregated; and 

7 (B) does not contain any persistent identi8 fier or other information that could readily be 

9 used to reidentify, or link the information to, 

10 the individual to whom, or the device to which, 

11 the identifier or information pertains. 

12 (9) INDEPENDENT REVIEW BOARD.—The term 

13 ‘‘independent review board’’ means a board, com14 mittee, or other group that— 

15 (A) serves to— 

16 (i) protect the autonomy and privacy 

17 of users; 

18 (ii) prevent exploitative and manipula19 tive acts or practices; 

20 (iii) promote transparent principles of 

21 user interface and user experience design; 

22 (iv) promote research in keeping with 

23 best practices of covered research; and 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2708 IS

1 (v) continually evaluate industry prac2 tices and issue guidance consistent with 

3 the objectives of this Act; and 

4 (B) is formally designated by a large on5 line operator to review, to approve the initiation 

6 of, and to conduct ongoing periodic reviews of, 

7 any covered research by, or at the direction or 

8 discretion of, a large online operator, involving 

9 human subjects. 

10 (10) LARGE ONLINE OPERATOR.—The term 

11 ‘‘large online operator’’ means any person that— 

12 (A) provides an online service that has 

13 more than 100,000,000 authenticated users of 

14 an online service in any 30-day period; and 

15 (B) is subject to the jurisdiction of the 

16 Commission under the Federal Trade Commis17 sion Act (15 U.S.C. 41 et seq.). 

18 (11) ONLINE SERVICE.—The term ‘‘online serv19 ice’’ means a website or a service, other than an 

20 internet access service, that is made available to the 

21 public over the internet, including a social network, 

22 a search engine, or an email service. 

23 (12) PUBLICLY AVAILABLE INFORMATION.— 

24 The term ‘‘publicly available information’’ means 

25 any information that a large online operator has a 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 2708 IS

1 reasonable basis to believe has been lawfully made 

2 available to the general public from— 

3 (A) Federal, State, or local government 

4 records; 

5 (B) widely distributed media, including— 

6 (i) information from a telephone book 

7 or online directory; 

8 (ii) television, internet, or radio con9 tent or programming; or 

10 (iii) a website or online service made 

11 available to all members of the public, for 

12 free or for a fee, including where all mem13 bers of the public, for free or for a fee, can 

14 log in to the website or online service; 

15 (C) a disclosure to the general public that 

16 is required to be made by Federal, State, or 

17 local law; or 

18 (D) the visual observation of the physical 

19 presence of an individual or a device in a public 

20 place, not including data collected by a device 

21 in the possession of the individual. 

22 (13) TEEN.—The term ‘‘teen’’ means an indi23 vidual over the age of 12 and under the age of 17. 

24 (14) USER.—The term ‘‘user’’ means any indi25 vidual who engages with an online service. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 2708 IS

1 (15) USER AUTONOMY.—The term ‘‘user auton2 omy’’ means the technical ability of a user to inter3 act with a user interface of an online service in a 

4 manner that aligns with personal intent. 

5 (16) USER DATA.—The term ‘‘user data’’— 

6 (A) means any information that identifies 

7 or is linked or reasonably linkable to an indi8 vidual or a device that is linked or reasonably 

9 linkable to an individual, whether directly sub10 mitted to the large online operator by the user 

11 or derived from the observed activity of the user 

12 by the large online operator; and 

13 (B) does not include— 

14 (i) aggregated data; 

15 (ii) de-identified data; or 

16 (iii) publicly available information, or 

17 inferences derived solely based on publicly 

18 available information. 

19 (17) USER EXPERIENCE.—The term ‘‘user ex20 perience’’ means how a user interacts with an online 

21 service. 

22 (18) USER INTERFACE.—The term ‘‘user inter23 face’’ means the point at which a user interacts with 

24 a system, device, or process of an online service. 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 2708 IS

1 SEC. 3. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RE2 LATING TO THE MANIPULATION OF USER 

3 INTERFACES. 

4 (a) CONDUCT PROHIBITED.—It shall be unlawful for 

5 any large online operator— 

6 (1) to design, modify, or manipulate a user 

7 interface on an online service with the purpose or 

8 substantial effect of obscuring, subverting, or im9 pairing user autonomy, decision making, or choice to 

10 obtain consent or user data; 

11 (2) to subdivide or segment consumers of online 

12 services into groups for the purposes of covered re13 search, except with the affirmative express consent 

14 of each user involved; or 

15 (3) to design, modify, or manipulate a user 

16 interface on an online service, or portion of a user 

17 interface or online service, that is directed to a child 

18 or teen with the purpose or substantial effect of 

19 causing, increasing, or encouraging compulsive 

20 usage, including using video auto-play functions ini21 tiated without the consent of a user. 

22 (b) DUTIES OF LARGE ONLINE OPERATORS.—Any 

23 large online operator that engages in any form of covered 

24 research based on the activity or data of the users of the 

25 large online operator shall do each of the following: 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 2708 IS

1 (1) Disclose to its users on a routine basis, but 

2 not less than once each 90 days, the general purpose 

3 of any such covered research to each user whose 

4 user data is or was subject to or included in any cov5 ered research during the previous 90-day period. 

6 (2) Disclose to the public on a routine basis, 

7 but not less than once each 90 days, any covered re8 search with the purposes of promoting engagement 

9 or product conversion being currently undertaken, or 

10 concluded since the prior disclosure. 

11 (3) Present the disclosures described in para12 graphs (1) and (2) in a manner that is— 

13 (A) clear, conspicuous, context-appropriate, 

14 and easily accessible; and 

15 (B) not deceptively obscured. 

16 (4)(A) Subject to subparagraph (B), remove 

17 and delete all user data obtained from affected users 

18 in the course of covered research if the large online 

19 operator— 

20 (i) determines (or determines that it has 

21 reason to believe) that the affirmative express 

22 consent required under this section from such 

23 users was not acquired; and 


kjohnson on DSK79L0C42PROD with BILLS
10 

•S 2708 IS

1 (ii) is unable to obtain within 2 business 

2 days of such determination the affirmative ex3 press consent required under this section. 

4 (B) If unable to remove and delete user data 

5 pursuant to subparagraph (A), discontinue the cov6 ered research. 

7 (5)(A) Establish a process by which a user may 

8 choose to opt out of covered research at a later date 

9 from when the user previously provided affirmative 

10 express consent for such research. 

11 (B) Subject to subparagraph (A), following the 

12 decision of a user to opt out, stop collecting, proc13 essing, or transferring any data from such user for 

14 the purposes of the covered research. 

15 (6) Establish an independent review board that 

16 shall— 

17 (A) develop, on a continuing basis and 

18 using the resources developed under section 4, 

19 guidance and rules for the development of user 

20 interface and user experience design of the 

21 large online operator that are consistent with 

22 the requirements of subsection (a) of this sec23 tion; and 

24 (B) review and have authority to approve, 

25 require modification in, or disapprove all covVerDate Sep 11 2014 00:25 Aug 18, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2708.IS S2708

kjohnson on DSK79L0C42PROD with BILLS
11 

•S 2708 IS

1 ered research conducted on users or on the 

2 basis of user activity or data consistent with 

3 subsection (a)(2). 

4 (7) Ensure that any independent review board 

5 established under paragraph (6) registers with the 

6 Commission, including providing to the Commis7 sion— 

8 (A) the names and resumes of every mem9 ber of the independent review board; 

10 (B) the composition and reporting struc11 ture of the independent review board to the 

12 management of the large online operator; 

13 (C) the process by which the independent 

14 review board is to be notified of covered re15 search or modifications of covered research, 

16 along with the processes by which the inde17 pendent review board is capable of vetoing or 

18 amending such research; 

19 (D) any compensation provided to mem20 bers of the independent review board; and 

21 (E) any conflict of interest that might 

22 exist concerning the participation of an indi23 vidual on the independent review board. 


kjohnson on DSK79L0C42PROD with BILLS
12 

•S 2708 IS

1 SEC. 4. NATIONAL INSTITUTE OF STANDARDS AND TECH2 NOLOGY RESOURCES. 

3 (a) IN GENERAL.—Not later than 540 days after the 

4 date of the enactment of this Act, the Director of the Na5 tional Institute of Standards and Technology shall, acting 

6 through the Information Technology Laboratory of the 

7 National Institute of Standards and Technology, conduct 

8 research to develop and disseminate consensus-based re9 sources consistent with subsection (b) that provide rec10 ommendations for user interface and user experience de11 sign that support user autonomy, choice, and decision 

12 making in providing user consent for online services. 

13 (b) CONTENT OF RESOURCES.—The resources devel14 oped under subsection (a) shall— 

15 (1) involve methodology for usability testing to 

16 identify usability problems by collecting quantitative 

17 and qualitative data to determine the ability of users 

18 to navigate options to achieve the specified goals of 

19 user autonomy, choice, and decision making in user 

20 interface and user experience design; 

21 (2) include examples or demonstrations of user 

22 interface design that may restrict the user auton23 omy, choice, or decision making of a user; and 

24 (3) include methodology to evaluate the ability 

25 to identify default settings that impair user auton26 omy. 


kjohnson on DSK79L0C42PROD with BILLS
13 

•S 2708 IS

1 SEC. 5. ENFORCEMENT BY THE COMMISSION. 

2 (a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 

3 A violation of section 3 or a regulation promulgated under 

4 this Act shall be treated as a violation of a rule defining 

5 an unfair or deceptive act or practice under section 

6 18(a)(1)(B) of the Federal Trade Commission Act (15 

7 U.S.C. 57a(a)(1)(B)). 

8 (b) POWERS OF THE COMMISSION.— 

9 (1) IN GENERAL.—The Commission shall en10 force section 3 and the regulations promulgated 

11 under this Act in the same manner, by the same 

12 means, and with the same jurisdiction, powers, and 

13 duties as though all applicable terms and provisions 

14 of the Federal Trade Commission Act (15 U.S.C. 41 

15 et seq.) were incorporated into and made a part of 

16 this Act. 

17 (2) PRIVILEGES AND IMMUNITIES.—Any person 

18 who violates section 3 or a regulation promulgated 

19 under this Act shall be subject to the penalties and 

20 entitled to the privileges and immunities provided in 

21 the Federal Trade Commission Act (15 U.S.C. 41 et 

22 seq.). 

23 (3) AUTHORITY PRESERVED.—Nothing in this 

24 Act shall be construed to limit or expand the author25 ity of the Commission under any other provision of 

26 law. 


kjohnson on DSK79L0C42PROD with BILLS
14 

•S 2708 IS

1 (4) REGULATIONS.—Not later than 2 years 

2 after the date of enactment of this Act, the Commis3 sion shall promulgate regulations under section 553 

4 of title 5, United States Code, that— 

5 (A) establish rules for the registration, for6 mation, and oversight of independent review 

7 boards, including standards that ensure effec8 tive independence of such boards from improper 

9 or undue influence by a large online operator; 

10 and 

11 (B) using the resources produced by the 

12 Director of the National Institute of Standards 

13 and Technology under section 4 as guidance, 

14 define conduct that does not have the purpose 

15 or substantial effect of— 

16 (i) obscuring, subverting, or impairing 

17 user autonomy, decision making, or choice; 

18 or 

19 (ii) causing, increasing, or encour20 aging compulsive usage for a child or teen, 

21 such as— 

22 (I) de minimis user interface 

23 changes derived from testing con24 sumer preferences where such changes 

25 of design elements are not done solely 


kjohnson on DSK79L0C42PROD with BILLS
15 

•S 2708 IS

1 to obtain affirmative express consent 

2 or user data; 

3 (II) algorithms or data outputs 

4 outside the control of a large online 

5 operator or the affiliates of such oper6 ator; and 

7 (III) establishing default settings 

8 that provide enhanced privacy protec9 tion to users or otherwise enhance the 

10 autonomy and decision-making ability 

11 of such users. 

12 (5) SAFE HARBOR.—The Commission may not 

13 bring an enforcement action under this Act against 

14 any large online operator that relied in good faith on 

15 the definitions developed under paragraph (4)(B). 

Æ 


kjohnson on DSK79L0C42PROD with BILLS