II 

115TH CONGRESS 

2D SESSION S. 2728 

To protect the privacy of users of social media and other online platforms. 

IN THE SENATE OF THE UNITED STATES 

APRIL 23, 2018 

Ms. KLOBUCHAR (for herself and Mr. KENNEDY) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To protect the privacy of users of social media and other 

online platforms. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Social Media Privacy 

5 Protection and Consumer Rights Act of 2018’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act— 

8 (1) the term ‘‘Commission’’ means the Federal 

9 Trade Commission; 


sradovich on DSK3GMQ082PROD with BILLS
2 

•S 2728 IS

1 (2) the term ‘‘covered online platform’’ means 

2 an online platform that collects personal data during 

3 the online behavior of a user of the online platform; 

4 (3) the term ‘‘geolocation information’’ means, 

5 with respect to an individual, any information that 

6 is not the content of a communication, concerning 

7 the location of a wireless communication device 

8 that— 

9 (A) in whole or in part, is generated by or 

10 derived from the operation of that device; and 

11 (B) could be used to determine or infer in12 formation regarding the location of the indi13 vidual; 

14 (4) the term ‘‘online platform’’— 

15 (A) means any public-facing website, web 

16 application, or digital application (including a 

17 mobile application); and 

18 (B) includes a social network, an ad net19 work, a mobile operating system, a search en20 gine, an email service, or an Internet access 

21 service; 

22 (5) the term ‘‘operator’’ has the meaning given 

23 the term in section 1302 of the Children’s Online 

24 Privacy Protection Act of 1998 (15 U.S.C. 6501); 

25 and 


sradovich on DSK3GMQ082PROD with BILLS
3 

•S 2728 IS

1 (6) the term ‘‘personal data’’ means individ2 ually identifiable information about an individual 

3 collected online, including— 

4 (A) location information sufficient to iden5 tify the name of a street and a city or town, in6 cluding a physical address; 

7 (B) an e-mail address; 

8 (C) a telephone number; 

9 (D) a government identifier, such as a So10 cial Security number; 

11 (E) geolocation information; 

12 (F) the content of a message; 

13 (G) protected health information, as de14 fined in section 160.103 of title 45, Code of 

15 Federal Regulations, or any successor regula16 tion; and 

17 (H) nonpublic personal information, as de18 fined in section 509 of the Gramm-Leach-Bliley 

19 Act (15 U.S.C. 6809). 

20 SEC. 3. PRIVACY PROTECTIONS. 

21 (a) TRANSPARENCY AND TERMS OF SERVICE.— 

22 (1) DISCLOSURE AND OBTAINING INITIAL CON23 SENT AND PRIVACY PREFERENCES.— 

24 (A) IN GENERAL.—Before a user creates 

25 an account with, or otherwise begins to use, a 


sradovich on DSK3GMQ082PROD with BILLS
4 

•S 2728 IS

1 covered online platform, the operator of the on2 line platform shall— 

3 (i) inform the user that, unless the 

4 user makes an election under clause 

5 (ii)(II), personal data of the user produced 

6 during the online behavior of the user, 

7 whether on the online platform or other8 wise, will be collected and used by the op9 erator and third parties; and 

10 (ii) provide the user the option to 

11 specify the privacy preferences of the user, 

12 including by— 

13 (I) agreeing to the terms of serv14 ice for use of the online platform, in15 cluding, except as provided in sub16 clause (II), the collection and use of 

17 personal data described in clause (i); 

18 and 

19 (II) prohibiting, if the user so 

20 elects, the collection and use of per21 sonal data described in clause (i), sub22 ject to subparagraph (B). 

23 (B) CONSEQUENCE OF PROHIBITION OF

24 DATA COLLECTION.—If the election of a user 

25 under subparagraph (A)(ii)(II) creates inoperVerDate Sep 11 2014 22:29 Apr 26, 2018 Jkt 079200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2728.IS S2728

sradovich on DSK3GMQ082PROD with BILLS
5 

•S 2728 IS

1 ability in the online platform, the operator of 

2 the online platform may deny certain services or 

3 completely deny access to the user. 

4 (C) FORM OF DISCLOSURE.—An operator 

5 of a covered online platform shall provide a user 

6 of the online platform with the terms of service 

7 for use of the online platform, including the col8 lection and use of personal data described in 

9 subparagraph (A)(i), in a form that— 

10 (i) is— 

11 (I) easily accessible; 

12 (II) of reasonable length; and 

13 (III) clearly distinguishable from 

14 other matters; and 

15 (ii) uses language that is clear, con16 cise, and well organized, and follows other 

17 best practices appropriate to the subject 

18 and intended audience. 

19 (D) PRIVACY OR SECURITY PROGRAM.—An 

20 operator of a covered online platform shall— 

21 (i) establish and maintain a privacy or 

22 security program for the online platform; 

23 and 

24 (ii) publish a description of the pri25 vacy or security program that— 


sradovich on DSK3GMQ082PROD with BILLS
6 

•S 2728 IS

1 (I) details how the operator will 

2 use the personal data of a user of the 

3 online platform, including require4 ments for how the operator will ad5 dress privacy risks associated with the 

6 development of new products and 

7 services; and 

8 (II) includes details of the access 

9 that employees and contractors of the 

10 operator have to the personal data of 

11 a user of the online platform, and in12 ternal policies for the use of that per13 sonal data. 

14 (2) NEW PRODUCTS; CHANGES TO PRIVACY OR

15 SECURITY PROGRAM.—An operator of a covered on16 line platform may not introduce a new product, or 

17 implement any material change to the privacy or se18 curity program of the online platform that overrides 

19 the privacy preferences of a user of the online plat20 form, as specified under paragraph (1)(A)(ii), unless 

21 the operator has— 

22 (A) informed the user that the new prod23 uct or change will result in the collection and 

24 use of personal data described in paragraph 

25 (1)(A)(i), if that is the case; 


sradovich on DSK3GMQ082PROD with BILLS
7 

•S 2728 IS

1 (B) provided the user the option under 

2 paragraph (1)(A)(ii); and 

3 (C) obtained affirmative express consent 

4 from the user to the introduction of the new 

5 product or the implementation of the change. 

6 (3) WITHDRAWAL OF CONSENT.—An operator 

7 of a covered online platform shall ensure that— 

8 (A) a user of the online platform is able to 

9 withdraw consent to the terms of service for use 

10 of the online platform, including the collection 

11 and use of personal data described in para12 graph (1)(A)(i), as easily as the user is able to 

13 give such consent; and 

14 (B) except as otherwise required by law, no 

15 person is able to access the personal data of a 

16 user of the online platform later than 30 days 

17 after the date on which the user closes his or 

18 her account or otherwise terminates his or her 

19 use of the online platform. 

20 (b) RIGHT TO ACCESS.—An operator of a covered on21 line platform shall offer a user of the online platform a 

22 copy of the personal data of the user that the operator 

23 has processed, free of charge and in an electronic and eas24 ily accessible format, including a list of each person that 


sradovich on DSK3GMQ082PROD with BILLS
8 

•S 2728 IS

1 received the personal data from the operator for business 

2 purposes, whether through sale or other means. 

3 (c) VIOLATIONS OF PRIVACY.— 

4 (1) IN GENERAL.—Not later than 72 hours 

5 after an operator of a covered online platform be6 comes aware that the personal data of a user of the 

7 online platform has been transmitted in violation of 

8 the privacy or security program of the online plat9 form, including the privacy preferences specified by 

10 the user under subsection (a)(1)(A)(ii), the operator 

11 shall— 

12 (A) notify the user of the transmission; 

13 (B) offer the user the option to elect to 

14 prohibit the operator from collecting and using 

15 the personal data of the user, subject to para16 graph (2); 

17 (C) except as provided in paragraph (3), 

18 offer the user the option to have the operator— 

19 (i) erase all personal data of the user 

20 tracked by the operator; and 

21 (ii) cease further dissemination of per22 sonal data of the user tracked by the oper23 ator; 

24 (D) offer the user a copy of the personal 

25 data of the user that the operator has procVerDate Sep 11 2014 22:29 Apr 26, 2018 Jkt 079200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2728.IS S2728

sradovich on DSK3GMQ082PROD with BILLS
9 

•S 2728 IS

1 essed, free of charge and in an electronic and 

2 easily accessible format, including a list of each 

3 person that received the personal data from the 

4 operator, whether through sale or other means; 

5 and 

6 (E) offer the user the option to close his 

7 or her account or otherwise terminate his or her 

8 use of the online platform. 

9 (2) CONSEQUENCE OF PROHIBITION OF DATA

10 COLLECTION.—If the election of a user under para11 graph (1)(B) creates inoperability in the online plat12 form, the operator of the online platform may deny 

13 certain services or completely deny access to the 

14 user. 

15 (3) PUBLIC SAFETY EXCEPTION.—If the oper16 ator of a covered online platform, in good faith, be17 lieves that an emergency involving danger of death 

18 or serious physical injury to any individual requires 

19 disclosure without delay of specific personal data of 

20 a user of the online platform that relates to the 

21 emergency, the operator shall— 

22 (A) retain the specific personal data; and 

23 (B) notify the proper authorities. 

24 (d) COMPLIANCE.—Not less frequently than once 

25 every 2 years, the operator of a covered online platform 


sradovich on DSK3GMQ082PROD with BILLS
10 

•S 2728 IS

1 shall audit the privacy or security program of the online 

2 platform. 

3 (e) SAFE HARBOR.—Subsections (a), (b), and (c) 

4 shall not apply with respect to the development of privacy5 enhancing technology by an operator of an online plat6 form. 

7 SEC. 4. ENFORCEMENT. 

8 (a) ENFORCEMENT BY COMMISSION.— 

9 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC10 TICES.—A violation of section 3 shall be treated as 

11 a violation of a rule defining an unfair or deceptive 

12 act or practice prescribed under section 18(a)(1)(B) 

13 of the Federal Trade Commission Act (15 U.S.C. 

14 57a(a)(1)(B)). 

15 (2) POWERS OF COMMISSION.— 

16 (A) IN GENERAL.—Except as provided in 

17 subparagraph (C), the Commission shall enforce 

18 this Act in the same manner, by the same 

19 means, and with the same jurisdiction, powers, 

20 and duties as though all applicable terms and 

21 provisions of the Federal Trade Commission 

22 Act (15 U.S.C. 41 et seq.) were incorporated 

23 into and made a part of this Act. 

24 (B) PRIVILEGES AND IMMUNITIES.—Ex25 cept as provided in subparagraph (C), any perVerDate Sep 11 2014 22:29 Apr 26, 2018 Jkt 079200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2728.IS S2728

sradovich on DSK3GMQ082PROD with BILLS
11 

•S 2728 IS

1 son who violates this Act shall be subject to the 

2 penalties and entitled to the privileges and im3 munities provided in the Federal Trade Com4 mission Act (15 U.S.C. 41 et seq.). 

5 (C) COMMON CARRIERS AND NONPROFIT

6 ORGANIZATIONS.—Notwithstanding section 4, 

7 5(a)(2), or 6 of the Federal Trade Commission 

8 Act (15 U.S.C. 44, 45(a)(2), 46) or any juris9 dictional limitation of the Commission, the 

10 Commission shall also enforce this Act, in the 

11 same manner provided in subparagraphs (A) 

12 and (B) of this paragraph, with respect to— 

13 (i) common carriers subject to the 

14 Communications Act of 1934 (47 U.S.C. 

15 151 et seq.) and Acts amendatory thereof 

16 and supplementary thereto; and 

17 (ii) organizations not organized to 

18 carry on business for their own profit or 

19 that of their members. 

20 (D) AUTHORITY PRESERVED.—Nothing in 

21 this Act shall be construed to limit the author22 ity of the Commission under any other provi23 sion of law. 

24 (b) ENFORCEMENT BY STATES.— 


sradovich on DSK3GMQ082PROD with BILLS
12 

•S 2728 IS

1 (1) AUTHORIZATION.—Subject to paragraph 

2 (2), in any case in which the attorney general of a 

3 State has reason to believe, based on a legitimate 

4 consumer complaint, that an interest of the residents 

5 of the State has been or is threatened or adversely 

6 affected by the engagement of any person subject to 

7 section 3 in a practice that violates that section, the 

8 attorney general of the State may, as parens patriae, 

9 bring a civil action on behalf of the residents of the 

10 State in an appropriate district court of the United 

11 States to obtain appropriate relief. 

12 (2) RIGHTS OF FEDERAL TRADE COMMIS13 SION.— 

14 (A) NOTICE TO FEDERAL TRADE COMMIS15 SION.— 

16 (i) IN GENERAL.—Except as provided 

17 in clause (iii), the attorney general of a 

18 State shall notify the Commission in writ19 ing that the attorney general intends to 

20 bring a civil action under paragraph (1) 

21 before initiating the civil action against a 

22 person described in subsection (a)(1). 

23 (ii) CONTENTS.—The notification re24 quired by clause (i) with respect to a civil 


sradovich on DSK3GMQ082PROD with BILLS
13 

•S 2728 IS

1 action shall include a copy of the complaint 

2 to be filed to initiate the civil action. 

3 (iii) EXCEPTION.—If it is not feasible 

4 for the attorney general of a State to pro5 vide the notification required by clause (i) 

6 before initiating a civil action under para7 graph (1), the attorney general shall notify 

8 the Commission immediately upon insti9 tuting the civil action. 

10 (B) INTERVENTION BY FEDERAL TRADE

11 COMMISSION.—The Commission may— 

12 (i) intervene in any civil action 

13 brought by the attorney general of a State 

14 under paragraph (1) against a person de15 scribed in subsection (a)(1); and 

16 (ii) upon intervening— 

17 (I) be heard on all matters aris18 ing in the civil action; and 

19 (II) file petitions for appeal of a 

20 decision in the civil action. 

21 (3) INVESTIGATORY POWERS.—Nothing in this 

22 subsection may be construed to prevent the attorney 

23 general of a State from exercising the powers con24 ferred on the attorney general by the laws of the 

25 State to conduct investigations, to administer oaths 


sradovich on DSK3GMQ082PROD with BILLS
14 

•S 2728 IS

1 or affirmations, or to compel the attendance of wit2 nesses or the production of documentary or other 

3 evidence. 

4 (4) ACTION BY FEDERAL TRADE COMMIS5 SION.—If the Federal Trade Commission institutes 

6 a civil action or an administrative action with re7 spect to a violation of section 3, the attorney general 

8 of a State may not, during the pendency of the ac9 tion, bring a civil action under paragraph (1) 

10 against any defendant named in the complaint of the 

11 Commission for the violation with respect to which 

12 the Commission instituted such action. 

13 (5) VENUE; SERVICE OF PROCESS.— 

14 (A) VENUE.—Any action brought under 

15 paragraph (1) may be brought in— 

16 (i) the district court of the United 

17 States that meets applicable requirements 

18 relating to venue under section 1391 of 

19 title 28, United States Code; or 

20 (ii) another court of competent juris21 diction. 

22 (B) SERVICE OF PROCESS.—In an action 

23 brought under paragraph (1), process may be 

24 served in any district in which the defendant— 

25 (i) is an inhabitant; or 


sradovich on DSK3GMQ082PROD with BILLS
15 

•S 2728 IS

1 (ii) may be found. 

2 (6) ACTIONS BY OTHER STATE OFFICIALS.— 

3 (A) IN GENERAL.—In addition to civil ac4 tions brought by attorneys general under para5 graph (1), any other consumer protection offi6 cer of a State who is authorized by the State 

7 to do so may bring a civil action under para8 graph (1), subject to the same requirements 

9 and limitations that apply under this subsection 

10 to civil actions brought by attorneys general. 

11 (B) SAVINGS PROVISION.—Nothing in this 

12 subsection may be construed to prohibit an au13 thorized official of a State from initiating or 

14 continuing any proceeding in a court of the 

15 State for a violation of any civil or criminal law 

16 of the State. 

17 SEC. 5. EFFECTIVE DATE. 

18 (a) IN GENERAL.—This Act shall take effect 180 

19 days after the date of enactment of this Act. 

20 (b) APPLICABILITY TO EXISTING USERS OF ONLINE

21 PLATFORMS.—An individual who becomes a user of a cov22 ered online platform before the effective date under sub23 section (a) shall be treated as if he or she had become 

24 a user of the online platform on that effective date. 


sradovich on DSK3GMQ082PROD with BILLS
16 

•S 2728 IS

1 (c) NO RETROACTIVE APPLICABILITY.—This Act 

2 shall not apply to any conduct that occurred before the 

3 effective date under subsection (a). 

Æ 


sradovich on DSK3GMQ082PROD with BILLS