Title: APP Act
Policy area: Commerce

Summary:
American Privacy Protection Act or the APP Act
This bill requires sellers of internet applications to disclose (1) the business name and address of the application's owner, (2) each location where the application was developed if more than 5% of the application was developed outside the United States, and (3) each location outside the United States where data collected by the application is stored.

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 4669 Introduced in Senate (IS)]

<DOC>






116th CONGRESS
  2d Session
                                S. 4669

  To require sellers of internet applications to disclose country-of-
              origin information, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                           September 23, 2020

Mr. Scott of Florida (for himself and Ms. Cortez Masto) introduced the 
 following bill; which was read twice and referred to the Committee on 
                 Commerce, Science, and Transportation

_______________________________________________________________________

                                 A BILL


 
  To require sellers of internet applications to disclose country-of-
              origin information, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``American Privacy Protection Act'' or 
the ``APP Act''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Internet application.--The term ``internet 
        application'' means a computer program or software application 
        that is downloaded by a user to an internet-connected device.

SEC. 3. COUNTRY OF ORIGIN DISCLOSURE REQUIREMENTS FOR SELLERS OF 
              INTERNET APPLICATIONS.

    (a) In General.--Beginning on the date that is 180 days after the 
date of the promulgation of final regulations implementing this 
section--
            (1) it shall be unlawful for any person to sell or 
        distribute an internet application unless the person discloses 
        to any individual who downloads such application, in a clear 
        and conspicuous manner and in the same language that is used on 
        the rest of the platform on which such application is sold or 
        distributed--
                    (A) the business name and address of the owner of 
                the application, the developer of the application, and 
                any parent company of such owner or developer;
                    (B) if more than 5 percent of the application was 
                developed outside of the United States, each location 
                in which the application was developed; and
                    (C) each location, if any, outside of the United 
                States in which data collected by the application is 
                stored; and
            (2) it shall be unlawful for the owner or developer of an 
        internet application to knowingly provide false information to 
        a seller or distributor of internet applications with respect 
        to any of the information described in paragraph (1).
    (b) Continuing Notification Requirement.--
            (1) In general.--A person shall not be considered to meet 
        the requirement of paragraph (1) unless the person provides an 
        individual with notice whenever the person has actual knowledge 
        that--
                    (A) a prior notice given to the individual under 
                paragraph (1) regarding an internet application was 
                incomplete or inaccurate with respect to the 
                information described in subparagraph (B) or (C) of 
                such paragraph; or
                    (B) the location where the internet application is 
                developed or stores data has changed so that the 
                information provided under a prior notice given to the 
                individual is incomplete or inaccurate with respect to 
                the information described in subparagraph (B) or (C) of 
                paragraph (1).
            (2) Timing.--A notice required under paragraph (1) shall be 
        provided by a person not later than 2 days after the earliest 
        date on which the person had actual knowledge described in such 
        paragraph.
    (c) Safe Harbor.--In complying with the requirement of subsection 
(a)(1) and subsection (b), the seller or distributor of an internet 
application may reasonably rely on representations made by the owner or 
developer of such application regarding the information described in 
subparagraphs (A) through (C) of subsection (a)(1).

SEC. 4. ENFORCEMENT.

    (a) Unfair and Deceptive Acts or Practices.--A violation of this 
Act or a regulation promulgated under this Act shall be treated as a 
violation of a rule defining an unfair or deceptive act or practice 
prescribed under section 18(a)(1)(B) of the Federal Trade Commission 
Act (15 U.S.C. 57a(a)(1)(B)).
    (b) Powers of Commission.--
            (1) In general.--The Commission shall enforce this Act and 
        any regulation promulgated under this Act in the same manner, 
        by the same means, and with the same jurisdiction, powers, and 
        duties as though all applicable terms and provisions of the 
        Federal Trade Commission Act (15 U.S.C. 41 et seq.) were 
        incorporated into and made a part of this Act.
            (2) Privileges and immunities.--Any person that violates 
        this Act or a regulation promulgated under this Act shall be 
        subject to the penalties and entitled to the privileges and 
        immunities provided in the Federal Trade Commission Act (15 
        U.S.C. 41 et seq.).
    (c) Enforcement by State Attorneys General.--In any case in which 
the attorney general of a State has reason to believe that an interest 
of the residents of that State has been or is threatened or adversely 
affected by the engagement of any person in a practice that violates 
this Act or a regulation prescribed under this Act, the State, as 
parens patriae, may bring a civil action on behalf of the residents of 
the State in a district court of the United States of appropriate 
jurisdiction to--
            (1) enjoin that practice;
            (2) enforce compliance with this Act or such regulation;
            (3) obtain damages, restitution, or other compensation on 
        behalf of residents of the State; or
            (4) obtain such other relief as the court may consider to 
        be appropriate.
    (d) Rulemaking.--The Commission shall promulgate in accordance with 
section 553 of title 5, United States Code, such rules as may be 
necessary to carry out this Act.
                                 <all>