Platform Accountability and Transparency Act

To support research about the impact of digital communication platforms on society by providing privacy-protected, secure pathways for independent research on data held by large internet companies. 1. Short title; table of contents (a) Short title This Act may be cited as the Platform Accountability and Transparency Act (b) Table of contents The table of contents for this Act is as follows: Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Qualified research projects, qualified researchers, and qualified data and information. Sec. 4. Obligations and immunity for platforms. Sec. 5. Obligations and immunity for qualified researchers. Sec. 6. Reporting. Sec. 7. Enforcement. Sec. 8. Amendment to the Communications Decency Act. Sec. 9. Establishing a safe harbor for research on social media platforms. Sec. 10. Rulemaking authority. Sec. 11. Authorization of appropriations. Sec. 12. Severability. 2. Definitions In this Act: (1) Commission The term Commission (2) Chair The term Chair (3) NSF The term NSF (4) Personal information The term personal information (5) Platform The term platform 15 U.S.C. 45(a)(2) (A) operates a website, desktop application, augmented or virtual reality application, or mobile application that— (i) permits a person to become a registered user, establish an account, or create a profile for the purpose of allowing the user to create, share, and view user-generated content through such an account or profile; (ii) enables one or more users to generate content that can be viewed by other users of the platform; and (iii) primarily serves as a medium for users to interact with content generated by other users of the platform and for the platform to deliver ads to users; and (B) has at least 50,000,000 unique monthly users in the United States for a majority of the months in the most recent 12-month period. (6) Qualified data and information (A) In general Subject to subparagraph (B), the term qualified data and information (i) that the NSF determines is necessary to allow a qualified researcher to carry out a qualified research project; and (ii) that— (I) is feasible for the platform to provide; (II) is proportionate to the needs of the qualified researchers to complete the qualified research project; (III) will not cause the platform undue burden in providing the data and information to the qualified researcher; and (IV) would not be otherwise available to the qualified researcher. (B) Exclusions Such term does not include any of the following: (i) Direct and private messages between users. (ii) Biometric information, such as a fingerprint, voiceprint, eye retinas, irises, or other unique biological patterns or characteristics. (iii) Precise geospatial information. (7) Qualified researcher (A) In general Subject to subparagraph (B), the term qualified researcher section 501(c) (B) Exclusion Such term does not include a researcher who is affiliated with a Federal, State, local, or tribal law enforcement or intelligence agency. (8) Qualified research project The term qualified research project (9) State The term State (10) User The term user 3. Qualified research projects, qualified researchers, and qualified data and information (a) Establishment Not later than 1 year after the date of enactment of this Act, the NSF and the Commission shall jointly establish a research program to review research applications for approval as qualified research projects. (b) Research program requirements The research program established by the NSF and the Commission under this section shall— (1) provide that the NSF shall— (A) establish a process to solicit research applications in order to identify qualified research projects; (B) review research applications for scientific merit; (C) ensure research applications identify proposed qualified researchers; (D) publish guidelines and criteria to be used by the NSF in determining how it will review research applications seeking approval to be a qualified research project; (E) identify, in consultation with the Commission, what data and information in a platform’s possession will be qualified data and information for the purposes of carrying out a qualified research project; (F) ensure that approved research applications do not request data described in section 2(6)(B); and (G) prescribe and publish guidelines and criteria, in consultation with the Commission, used to determine how the NSF and Commission will identify qualified data and information necessary to conduct a qualified research project; (2) provide that the Commission shall— (A) review research applications for privacy and cybersecurity risks; (B) establish appropriate privacy and cybersecurity safeguards that a platform must implement in the provision of, and with which qualified researchers must comply to access, qualified data and information that a platform is required to share with qualified researchers pursuant to a qualified research project, and such safeguards— (i) must account for the relative sensitivity of the qualified data and information involved and be sufficient to protect such data and information; and (ii) may include alternative protections, as appropriate and in consideration of the aims of the qualified research project, including— (I) encryption of the data in transit and when not in use; (II) delivery of the data in a format that employs methods to prevent qualified researchers from identifying individuals in the dataset; (III) data access logs; and (IV) keystroke logs; (C) in the case of each qualified research project, consider whether to require the platform to provide a secure physical or virtual environment to facilitate delivery of the qualified data and information; (D) establish appropriate privacy and cybersecurity safeguards that a qualified researcher must implement when receiving, storing, or analyzing qualified data and information or generating new data using such qualified data and information, including inferential data based on such qualified data and information, and such safeguards may include a requirement that a qualified researcher delete qualified data and information after completion of a qualified research project, however any such safeguard must provide the qualified researcher the ability to retain enough information about the qualified data and information to allow the researcher or their peers to recreate the qualified research project upon request to, and approval from, the NSF and Commission pursuant to this section; (E) publish a list of criteria for determining the privacy and cybersecurity safeguards required for qualified data and information related to a qualified research project; (F) provide platforms with the opportunity to provide comment about the privacy and cybersecurity safeguards required for a qualified research project; (G) provide researchers with the opportunity to provide comment about the privacy and cybersecurity safeguards required for a qualified research project; (H) establish a process to ensure that qualified researchers will be able to comply with any such privacy and cybersecurity safeguards; and (I) publish a list of criteria for determining whether qualified researchers will be able to comply with any such privacy and cybersecurity safeguards; (3) provide that a research application may not be denied on grounds of the race, color, age, sex, national origin, political affiliation, or disability of the researcher; (4) provide that a research application shall not be approved as a qualified research project unless it— (A) has been approved by an institutional review board; (B) has been deemed exempt from institutional review board review; or (C) is excluded from the criteria for institutional review board review; (5) provide a platform the opportunity to comment on and appeal the approval of a qualified research project for which the platform is required to provide qualified data and information to the NSF and Commission on the grounds that— (A) the platform cannot provide the qualified data and information; (B) providing access to the qualified data and information would lead to significant vulnerabilities in the security of the platform’s service or user privacy; or (C) the privacy and cybersecurity safeguards established by the Commission are not sufficient to protect the qualified data and information; and (6) require that any analysis by a qualified researcher derived from a qualified research project that the qualified researcher intends to publish undergo prepublication review by the Commission to ensure that the analysis does not expose personal information, or trade secrets. (c) Qualified researcher capacity A qualified research project may not proceed unless the proposed qualified researchers can demonstrate that they have the capacity to comply with the privacy and cybersecurity safeguards established for the qualified research project. (d) Aim of project A research application shall not be approved as a qualified research project unless it is in the public interest, aims to study activity on a platform, and is used for noncommercial purposes. (e) No judicial review A determination by the Commission and the NSF under this section regarding whether a research application will be deemed a qualified research project shall not be subject to judicial review. (f) No government access If a platform provides qualified data and information to a qualified researcher, no government entity may seek access to such qualified data and information from the qualified researcher. (g) Researcher consortia The Commission and NSF shall establish procedures and necessary safeguards under this section that allow for consortia of researchers to apply to seek data for the purpose of conducting a series of qualified research projects. 4. Obligations and immunity for platforms (a) Provision of qualified data and information A platform shall provide access to qualified data and information relating to a qualified research project to a qualified researcher under the terms and privacy and cybersecurity safeguards dictated by the Commission for the purpose of carrying out the qualified research project. (b) Continued access to qualified data and information (1) In general A platform may not restrict or terminate a qualified researcher’s access to qualified data and information for an ongoing qualified research project unless the platform has a reasonable belief that the qualified researcher is not acting in accordance with the cybersecurity and privacy safeguards required for the qualified research project. (2) Notice and review of change to access If a platform restricts or terminates a qualified researcher's access to qualified data and information for an ongoing qualified research project— (A) the platform shall, within a reasonable time (as established by the Commission), inform the Commission in writing that the platform has restricted or terminated the qualified researcher's access to the qualified data and information; and (B) the Commission shall promptly review the platform's decision and determine whether the qualified researcher has violated the privacy and cybersecurity safeguards established for the qualified research project. (c) Notice to platform users The Commission shall issue regulations requiring that platforms, through posting of notices or other appropriate means, keep users informed of their privacy protections and the information that the platform is required to share with qualified researchers under this Act. (d) Safe harbor No cause of action under State or Federal law arising solely from the release of qualified data and information to qualified researchers in furtherance of a qualified research project may be brought against any platform that complies with the Act. (e) Right of review If a platform fails to provide all of the qualified data and information required under the terms of a qualified research project to the qualified researcher conducting the project, the qualified researcher or the researcher's affiliated university or nonprofit organization may bring an action in district court for injunctive relief or petition the Commission to bring an enforcement action against the platform. (f) Security Nothing in this Act shall be construed to restrict a platform’s ability to: (1) Take immediate steps to protect an interest that is essential for the life or physical safety of a natural person. (2) Respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity, preserve the integrity of security of systems, or investigate or report those responsible for such actions. 5. Obligations and immunity for qualified researchers (a) Scope of permitted use of qualified data and information Each qualified researcher who accesses qualified data and information shall use the qualified data and information— (1) only for the purposes of conducting research authorized under the terms of the qualified research project involved; and (2) in accordance with the privacy and cybersecurity safeguards prescribed by the Commission for the qualified research project. (b) Protection of personal information A qualified researcher that is provided access to qualified data and information for purposes of a qualified research project may not— (1) attempt to reidentify, disclose, publish, or use for commercial purpose personal information derived from such qualified data and information; or (2) disclose such qualified data and information to a third party for any reason. (c) Effect of violation of information and privacy standards Qualified researchers who intentionally, recklessly, or negligently violate the privacy and cybersecurity safeguards prescribed by the Commission for a qualified research project may be subject to both civil and criminal enforcement, under applicable Federal, State, and local laws. The Commission may refer any such violation to the Department of Justice or the appropriate State law enforcement agency. 6. Reporting Not later than 24 months after the date of enactment of this Act, and annually thereafter, the NSF and the Commission shall submit to the Congress a joint report regarding the operation of this Act, which shall include a detailed statement of all qualified research projects, including with respect to each such project: (1) The identity of any authorized qualified researcher and the institution the researcher is affiliated with. (2) The platforms required to provide qualified data and information to qualified researchers. (3) The categories of qualified data and information each platform was required to provide. (4) The terms of the privacy and cybersecurity safeguards prescribed by the Commission to ensure the security of the qualified data and information. (5) Any recommendations for improvements to the operation of this Act in order to facilitate its aim of providing enhanced platform transparency. 7. Enforcement (a) Unfair or deceptive act or practice (1) In general A platform's failure to comply with subsection (a) or (b) of section 4, or a qualified researcher's failure to comply with subsection (a) or (b) of section 5, shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (2) Powers of the Commission (A) In general The Commission shall enforce the provisions of this Act specified in paragraph (1) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. (B) Privileges and immunities Any person that violates the provisions of this Act specified in paragraph (1) shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. (b) Regulations The Commission shall have the authority to promulgate, in the manner prescribed by 5 U.S.C. 553 (c) Civil enforcement authority Whenever the Commission shall have reason to believe that a platform or qualified researcher has been or is in violation of any provision of this Act, the Commission may commence a civil action in a district court of the United States for an injunction against the platform or qualified researcher. Remedies in an injunctive action brought by the Commission are limited to an order enjoining, restraining, or preventing any act or practice that constitutes a violation of this Act and imposing a civil penalty of up to $10,000 for each violation, which shall accrue to the United States and may be recovered in a civil action brought by the Attorney General of the United States. Such penalty shall be in addition to other penalties as may be prescribed by law. (d) Attorney's fees and other costs In the event any enforcement action is appealed, the prevailing party in the action may, in the discretion of the court, recover the costs of the action including reasonable investigative costs and attorneys' fees. 8. Amendment to the Communications Decency Act Section 230(c)(1) of the Communications Act of 1934 ( 47 U.S.C. 230(c)(1) (1) by striking No provider or user (A) In general Except as provided in subparagraph (B), no provider or user ; and (2) by adding at the end the following: (B) Data access and transparency compliance (i) Definitions In this subparagraph, the terms platform qualified data and information qualified researcher qualified research project Platform Accountability and Transparency Act (ii) Exception to immunity Subparagraph (A) shall not apply with respect to a claim against a provider of an interactive computer service in a civil action if— (I) the provider is a platform that has been determined by a final order of the Federal Trade Commission or a Federal court to have failed to provide qualified data and information pursuant to a qualified research project, in violation of section 6(a) of the Platform Accountability and Transparency Act (II) this failure to comply was a direct and substantial contributor to the harm alleged by the claimant that is the basis for the claim to relief. . 9. Establishing a safe harbor for research on social media platforms (a) In general No civil claim will lie, nor will any criminal liability accrue, against any person for collecting covered information as part of a news-gathering or research project on a platform, so long as— (1) the information is collected through a covered method of digital investigation; (2) the purpose of the project is to inform the general public about matters of public concern; (3) with respect to information that is collected through a covered method of digital investigation— (A) the information is not used except to inform the general public about matters of public concern; and (B) the person takes reasonable measures to protect the privacy of the platform's users; (4) with respect to the creation and use of a research account, the person takes reasonable measures to avoid misleading the platform’s users; and (5) the project does not materially burden the technical operation of the platform. (b) Regulations No later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5— (1) defining covered method of digital investigation, (A) the collection of data from a platform's user-facing interface through automated means; (B) the collection of data donated by a user, including through a browser extension or plug-in, where the donation is in connection with the project and with the user's explicit consent; and (C) the creation or use of research accounts; (2) defining covered information, (A) publicly available information, except that such term should not exclude data merely because an individual must log into an account in order to see it; (B) information about ads shown on the platform, including the ads themselves, the advertiser’s name and disclosure string, and information the platform provides to users about how an ad was targeted; and (C) any other category of information the collection of which the Commission determines, consistent with paragraph (3), will not unduly burden user privacy; (3) defining reasonable measures to protect the privacy of the platform’s users (A) avoid the collection and retention of non-public information that would readily identify a user without that user's consent; (B) prevent the theft and accidental disclosure of any data collected; (C) ensure that the data at issue is not used for any purpose other than to inform the general public about matters of public concern; and (D) restrict the publication or other disclosure of any data that would readily identify a user without the user's consent, except when such user is— (i) an advertiser and the data concerns an advertisement; or (ii) a public official, candidate for public office, or public figure; (4) defining reasonable measures to avoid misleading the platform’s users (5) defining materially burden the technical operation of a platform (c) Amendment of regulations The Commission may, as necessary, in consultation with relevant stakeholders, amend regulations promulgated pursuant to subsection (b) to the extent such amendment will accomplish the purposes of this section. (d) Reporting In December of each calendar year beginning with calendar year 2023, the Commission shall require each operator of any platform to submit an annual report to the Commission that addresses whether the measures prescribed under subsections (b)(3) and (b)(4) of this section are adequately protecting the platform’s users. (e) Definition of research account For purposes of this section, the term research account 10. Rulemaking authority (a) Additional reporting requirements (1) In general In consultation with the NSF, the Commission may, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations that require platforms to make available to qualified researchers data, metrics, or other information that the Commission determines will facilitate independent research in the public interest into activity on platforms. (2) Factors In exercising its authority under this subsection, the Commission shall consider the extent to which disclosures under this subsection may facilitate collaboration amongst qualified researchers and alleviate burdens on platforms and qualified researchers as compared to qualified research projects conducted pursuant to section 3. (3) Form and frequency; retention of information The Commission shall specify in the regulations the required form and frequency of reporting or disclosures, as well as how long information should be retained and made available. It may require the information be provided in a form that is accessible for analysis by qualified researchers, such as through an application programming interface. (4) Consultation The Commission shall further consult with the National Institutes of Health and other relevant government agencies, as appropriate, in exercising its authority under this subsection. (5) Applicability of prior sections The Commission shall establish privacy and cybersecurity safeguards applicable to platforms and qualified researchers for data made available to qualified researchers under this section in the manner described in section 3 for data made available under that section. The obligations and immunities for platforms and qualified researchers described in sections 4 and 5 shall apply to data disclosed to qualified researchers under this section, and the provisions of section 7 may be invoked to enforce this section. (b) Transparency of certain content and user accounts (1) In general Not later than 1 year after the date of enactment of this Act, the Commission shall, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations to require platforms to make available to the public on an ongoing basis, in a specific section of their online interface, through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces, a repository containing information regarding reasonably public content on the platform that— (A) has been highly disseminated; or (B) was originated or spread by major public accounts. (2) Disclosure of public content samplings The regulations issued under paragraph (1) shall further require platforms to disclose on an ongoing basis statistically representative samplings of reasonably public content, including, at a minimum, a sampling that is weighted by the number of impressions the content receives. (3) Required information The information required to be disclosed about content described in paragraphs (1) and (2) shall include, as appropriate— (A) the user-generated content itself, including any text, images, videos, links, and keywords; (B) platform-generated content displayed in connection with the user-generated content, including any dates, labels, disclaimers, or metrics; (C) metrics about the extent of dissemination of or engagement with the content, including the number of impressions, reach, and engagements; (D) information about the extent to which the content was recommended, amplified, or restricted by platform algorithms or policies; (E) reasonably public information about the user accounts responsible for the content; and (F) public uniform resource locators that uniquely link to the content and identify related materials such as the parent content, replying content, and cross-posted content. (4) Highly disseminated content As part of the regulations issued under paragraph (1), the Commission shall define highly disseminated (5) Major public accounts As part of the regulations issued under paragraph (1), the Commission shall define major public accounts major public accounts (6) Treatment of content that has been removed The regulations described in paragraph (1) shall provide guidance regarding disclosure of content that is removed by the user or platform subsequent to its dissemination. (7) Frequency To the extent practicable, the Commission shall require this information to be updated so as to provide a real-time understanding of the content described in paragraphs (1) and (2). (c) Transparency of advertising (1) In general Not later than 1 year after the date of enactment of this Act, the Commission shall, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations to require platforms to disclose on an ongoing basis information regarding advertising on the platform. These regulations shall require platforms to compile and disclose publicly in a specific section of their online interface, through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces, a repository containing the information referred to in paragraph (2), for the entire period during which they present an advertisement and until one year after the advertisement was presented for the last time on their online interfaces. Platforms shall ensure that the repository does not contain any personal data of the recipients of the service to whom the advertisement was or could have been presented. (2) Information required The information required to be included in the repository required under paragraph (1) shall include at least all of the following information: (A) The content of the advertisement, including the name of the product, service or brand and the subject matter of the advertisement. (B) The natural or legal person on whose behalf the advertisement is presented. (C) The natural or legal person who paid for the advertisement, if that person is different from the person referred to in subparagraph (B). (D) The period during which the advertisement was presented. (E) Whether the advertisement was intended to be presented specifically to one or more particular groups of recipients of the service and if so, the main parameters used for that purpose including where applicable the main parameters used to exclude one or more of such particular groups. (F) The total number of recipients of the service reached and, where applicable, aggregate numbers broken down by group or groups of recipients that the advertisement specifically targeted. (G) Information about the extent to which the advertisement was recommended, amplified, or restricted by platform algorithms or policies. (3) Treatment of removed ads The regulations described in paragraph (1) shall provide guidance regarding disclosure of ads that are removed by the user or platform subsequent to its dissemination. (4) Frequency To the extent practicable, the Commission shall require this information to be updated so as to provide a real-time understanding of the content described in paragraph (2). (d) Transparency of algorithms and company metrics and data (1) In general Not later than 1 year after enactment of this Act, the Commission shall, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations to require platforms to report publicly on their use of recommender or ranking algorithms and metrics. (2) Required information The reporting required under paragraph (1) shall be at least semiannual and include, as appropriate— (A) a description of all consumer-facing product features that made use of recommender or ranking algorithms during the reporting period; (B) a summary of signals used as inputs to the described recommender or ranking algorithms, including an explanation of which rely on user data, an explanation of the types of user data relied upon, and ranked based on the significance of their impact on the algorithms’ outputs; (C) a summary of the processes or predictions used by the platform to assess the signals incorporated into the recommender or ranking algorithm and to score or rank content (such as predictions of future user engagement), ranked based on the significance of their impact on the algorithms’ outputs; (D) a summary of the optimization objectives of the described recommender or ranking algorithms; (E) a summary of metrics calculated by the platform to assess product changes or new features, or as a basis to assess performance or calculate employee or executive compensation, with an assessment of their relative importance in company decision making; (F) significant changes during the reporting period from the last report; and (G) other information about the recommender or ranking algorithms that the Commission deems appropriate. (3) Implementation In implementing this section, the Commission shall ensure that the reporting is useful and actionable while ensuring that platforms are not required to disclose trade secrets. (e) Transparency of content moderation and violating content (1) In general Not later than 1 year after the date of enactment of this Act, the Commission shall, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations to require platforms to report on an ongoing basis information regarding content moderation and content violating platform policies. (2) Required information The information required to be disclosed under paragraph (1) shall include, as appropriate— (A) statistics regarding the amount of content that the platform determined violated its policies, broken down by— (i) the violated policy; (ii) the action taken in response to the violation; (iii) the methods the platform used to identify the violating content (such as artificial intelligence, user report, human moderator review, or other means); (iv) the extent to which the content was recommended, amplified, or restricted by platform algorithms or policies; and (v) geographic and demographic factors as the Commission deems appropriate; (B) statistics regarding the number of times violating content was viewed by users and the number of users who viewed it; (C) estimates by the platform about the prevalence of violating content (including as measured by the number of impressions of violating content), broken down by— (i) the violated policy; (ii) geographic and demographic factors; and (iii) other factors the Commission deems appropriate; and (D) the number of orders received from governmental authorities, categorized by the type of illegal content concerned, and the average time needed for taking the action specified in those orders. (f) Data dictionaries Not later than 1 year after the date of enactment of this Act, the Commission shall, in accordance with section 553 of title 5, United States Code, and subject to subsection (g), issue regulations to require platforms to disclose, and update periodically, data dictionaries to inform and facilitate researcher data access requests. Such data dictionaries shall include descriptions of significant datasets in the platform’s possession relating to content on, or users of, the platform, enforcement of content policy, or advertising, as necessary or appropriate to inform and facilitate researcher data access requests. (g) Privacy, confidentiality, and platform integrity The Commission shall ensure that any reporting or disclosures required pursuant to this section do not infringe upon reasonable expectations of personal privacy of users of platforms or of other persons, or require dissemination of trade secrets. If necessary, the Commission may require withholding of information otherwise required to be disclosed to meet this requirement. The Commission shall further consider the effect of disclosures on risks to platform integrity or the susceptibility of the platform to manipulation or inauthentic behavior, and may limit or reduce the information required to be disclosed if necessary to address a substantial such risk. (h) Variation In implementing this section, the Commission may vary the requirements it imposes on platforms based on the size of the platform and scope of its services. (i) Definitions In this section: (1) Engagement The term engagement (2) Impression The term impression (3) Prevalence of violating content The term prevalence of violating content (4) Reach The term reach (5) Real-time understanding The term real-time understanding (6) Reasonably public The term reasonably public (7) Recommender or ranking algorithm The term recommender or ranking algorithm 11. Authorization of appropriations There are authorized to be appropriated to the NSF and the Commission such sums as are necessary to carry out this Act for fiscal year 2022 and each succeeding fiscal year. 12. Severability If any provision of this Act, or the application of such provision to any person or circumstance, is held to be unconstitutional, the remainder of this Act, and the application of the remaining provisions of this Act, to any person or circumstance, shall not be affected.

Summary: Platform Accountability and Transparency Act This bill increases access to the data of large technology platforms (i.e., platforms with at least 50 million unique monthly users in the United States) in order to facilitate research concerning activities on those platforms, particularly by requiring platforms to disclose data to researchers who participate in a research program jointly established by the National Science Foundation and the Federal Trade Commission.