Know Your App Act

To require application stores to publicly list the country of origin of the applications that they distribute, and to provide consumers the ability to protect themselves. 1. Short title This Act may be cited as the Know Your App Act 2. Findings; sense of Congress (a) Findings Congress finds the following: (1) Minors engaging with internet-linked applications face heightened susceptibility to privacy risks and potential exploitation through those applications. It is crucial for parents and guardians to possess comprehensive knowledge about the applications being accessed so that they can make informed decisions to protect their children. (2) Many users are unaware of the country of origin of the applications they download and use, as well as the data handling practices of the developers behind those applications. This lack of transparency can lead to potential risks for users, including exposure to foreign government surveillance, data breaches, and privacy violations. Users have a right to know baseline information on the country of origin so that they can personally make decisions to mitigate the threat to their personal and biometric information. (3) The potential for foreign governments to access user data through internet-linked applications presents national security risks. These risks may include the collection of sensitive information, espionage, and potential influence over critical infrastructure. (4) Increasing transparency and providing users with the necessary information to make informed decisions about the applications they download can help protect consumer privacy and security. (b) Sense of Congress It is the sense of Congress that covered companies and developers already posses the information necessary to provide adequate transparency to consumers. 3. Public listing of country of origin of applications (a) Definitions In this section: (1) Application The term application (2) Application store The term application store (A) distributes applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing device; and (B) has more than 20,000,000 users in the United States. (3) Application store page The term application store page (4) Assistant Secretary The term Assistant Secretary (5) Beneficial owner The term beneficial owner (A) means, with respect to a developer of an application, an individual who, directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise— (i) exercises substantial control over the developer; or (ii) owns or controls not less than 25 percent of the ownership interests of the developer; and (B) does not include— (i) a minor child, as defined in the State in which the entity is formed, if the information of the parent or guardian of the minor child is reported in accordance with this section; (ii) an individual acting as a nominee, intermediary, custodian, or agent on behalf of another individual; (iii) an individual acting solely as an employee of a corporation, limited liability company, or other similar entity and whose control over or economic benefits from such entity is derived solely from the employment status of the individual; (iv) an individual whose only interest in a corporation, limited liability company, or other similar entity is through a right of inheritance; or (v) a creditor of a corporation, limited liability company, or other similar entity, unless the creditor meets the requirements of subparagraph (A). (6) Country of concern The term country of concern (7) Country of origin The term country of origin (A) with respect to the developer of an application, means the country in which the developer is headquartered or principally operates; and (B) with respect to the beneficial owner of the developer of an application— (i) except as provided in clause (ii), means the country from which the beneficial owner principally exercises control over the developer; and (ii) if the beneficial owner exercises any control over the developer from a country of concern, means that country. (8) Covered company The term covered company (9) Developer The term developer (10) Primary country of origin The term primary country of origin (A) except as provided in subparagraph (B), means the country of origin of the developer of the application; and (B) if the country of origin of the beneficial owner of the developer of the application is a country of concern, means that country. (11) Prominent display The term prominent display (b) Requirements (1) Public listing The Assistant Secretary shall require a covered company to publicly list, in a prominent display on the application store page, the primary country of origin of each application distributed through an application store owned, controlled, or operated by the covered company. (2) Protections regarding certain foreign countries (A) Filter for certain applications The Assistant Secretary shall require a covered company to provide users of the covered company's application store with the option to filter out applications whose primary country of origin is a country of concern. (B) Disclaimer for certain applications The Assistant Secretary shall require that if the primary country of origin of an application is a country of concern, a covered company that distributes the application through an application store shall provide a disclaimer, in a prominent display on the application store page, that data from the application could be accessed by a foreign government. (3) Update of information (A) In general The Assistant Secretary shall require a developer to notify a covered company whose application store distributes the developer’s application of any change in— (i) the country of origin of the developer; (ii) the beneficial owner of the developer; or (iii) the country of origin of the beneficial owner of the developer. (B) Developer certification (i) In general The Assistant Secretary shall require a developer to certify to each covered company that owns, controls, or operates an application store through which the developer's application is distributed, not less frequently than annually, that the information displayed on the application store page with respect to the application, including primary country of origin and beneficial ownership, is up-to-date. (ii) Violations If a developer violates clause (i)— (I) the covered company shall issue the developer a series of not fewer than 3 warnings over a period of not more than 90 days; and (II) if the developer does not correct the violation by the date that is 90 days after the date on which the first warning is issued under subclause (I), the covered company shall remove the application of the developer from the application store. (4) Reporting mechanism The Assistant Secretary shall require a covered company to establish a mechanism that— (A) allows a user of the covered company's application store, an employee of a developer whose application is distributed through the covered company's application store, or an associated third party to report a potential violation of this subsection by a developer, including incorrect information displayed on the application store page; and (B) allows a report under subparagraph (A) to be made anonymously. (5) Written policy for appeals of removals The Assistant Secretary shall require a covered company to establish, for any application store owned, controlled, or operated by the covered company, a clear written policy for how a developer can appeal the removal of an application from the application store and have the application be reinstated. 4. List of foreign countries with national laws resulting in government control over applications (a) In general Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Secretary of the Treasury and the Secretary of Commerce shall jointly develop and submit to Congress a list of each foreign country that has in effect a national law that may subject a developer or application to control by the government of the country over content moderation, algorithm design, or user data transfers. (b) Publication With respect to the list developed under subsection (a)— (1) the Secretary of the Treasury shall make the list publicly available on the website of the Department of the Treasury; and (2) the Secretary of Commerce shall make the list publicly available on the website of the Department of Commerce. 5. Limitation of enforcement and regulation The Assistant Secretary may not exercise any enforcement authority or regulatory authority over a covered company or developer that is not provided under this Act, including through rulemaking. 6. Enforcement The Attorney General may bring a civil action in an appropriate district court of the United States against any covered company that violates this Act.

Summary: Know Your App Act This bill requires the National Telecommunications and Information Administration (NTIA) to undertake actions to inform customers about the country of origin of applications (apps) and dangers of certain foreign apps. Specifically, the NTIA must require app stores with more than 20 million U.S. customers to prominently display the country of origin for each app they distribute. In addition, app stores must enable customers to filter out apps that originate from countries of concern. These are countries, identified by the Departments of the Treasury and Commerce, with laws that allow governmental control of content moderation, algorithm design, or user data. App store pages for apps originating from a country of concern must include a disclaimer that warns customers about the potential for a foreign government to control functions of the app. Additionally, app developers must (1) certify to app stores that the information about the app displayed on the app store page, including country of origin and ownership, is correct; and (2) notify app stores about relevant changes in the country of origin or ownership. If a developer fails to provide the certification or update incorrect information, the app store must remove the app. App stores must also establish (1) a reporting mechanism to allow individuals to anonymously report when information about an app is incorrect, and (2) written policies for developers to appeal the removal of an app from the store. The bill provides for enforcement by the Department of Justice.