Title: DATA Act
Policy area: Commerce

Summary:
Data and Algorithm Transparency Agreement Act or the DATA Act
This bill requires large websites and social networks that use algorithms for suggesting content to obtain express consent from their users before collecting or sharing their personal data. These websites must notify users of this requirement, including information about the type of data collected and the name of any third parties with which the data is shared.
The bill provides for enforcement by the Federal Trade Commission and a private right of action against a violator of the bill.

[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 1477 Introduced in Senate (IS)]

<DOC>






117th CONGRESS
  1st Session
                                S. 1477

 To impose notice and consent requirements on internet platforms that 
    use algorithms to manipulate the availability of content on the 
                               platform.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             April 29, 2021

  Mr. Scott of Florida introduced the following bill; which was read 
     twice and referred to the Committee on Commerce, Science, and 
                             Transportation

_______________________________________________________________________

                                 A BILL


 
 To impose notice and consent requirements on internet platforms that 
    use algorithms to manipulate the availability of content on the 
                               platform.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Data and Algorithm Transparency 
Agreement Act'' or the ``DATA Act''.

SEC. 2. NOTICE AND CONSENT REQUIREMENTS FOR INTERNET PLATFORMS THAT USE 
              ALGORITHMS TO MANIPULATE THE AVAILABILITY OF PLATFORM 
              CONTENT.

    (a) In General.--Beginning 1 year after the date of enactment of 
this Act, any covered platform shall comply with the requirements of 
subsection (c).
    (b) Definitions.--In this Act:
            (1) Covered data.--The term ``covered data'' means, with 
        respect to an individual, data regarding the habits, traits, 
        preferences, beliefs, or location of the individual.
            (2) Covered platform.--the term ``covered platform'' means 
        a public-facing website, internet application, or mobile 
        internet application, including a social network, video sharing 
        service, ad network, mobile operating system, search engine, 
        email service, or internet access service that--
                    (A) has not less than 30,000,000 active monthly 
                users in the United States; and
                    (B) uses an algorithm to increase or decrease the 
                availability of content on the website or application.
    (c) Requirements.--
            (1) No collection of covered data without consent.--
                    (A) In general.--A covered platform shall not 
                collect any covered data of an individual without 
                obtaining the individual's express consent for such 
                data collection.
                    (B) Revocation of consent; right to delete.--A 
                covered platform shall--
                            (i) allow any individual to revoke or 
                        withdraw the individual's prior consent to the 
                        covered platform collecting the individual's 
                        covered data; and
                            (ii) at the request of an individual, 
                        delete any covered data of the individual 
                        collected or held by the platform.
            (2) No sale, sharing, or conveyance of data without 
        consent.--
                    (A) In general.--A covered platform shall not sell, 
                share, or otherwise convey to a third party entity any 
                covered data of an individual without obtaining the 
                individual's express consent.
                    (B) Revocation of consent.--A covered platform 
                shall allow any individual to revoke or withdraw the 
                individual's prior consent to any sale, sharing, or 
                conveyance of the individual's covered data.
            (3) Notice of requirements.--
                    (A) In general.--A covered platform shall provide 
                notice to users of the platform of the requirements 
                described in paragraphs (1) and (2).
                    (B) Manner of notification.--The notice required 
                under subparagraph (A) shall contain the information 
                described in subparagraph (C) and shall be provided by 
                a covered platform to a user--
                            (i) in plain language and in a conspicuous 
                        manner;
                            (ii) in addition to any notice relating to 
                        the terms of service of the platform;
                            (iii) each time the user logs in to the 
                        platform unless the user affirmatively waives 
                        receiving the notice; and
                            (iv) each time the platform modifies its 
                        terms of service.
                    (C) Contents of notification.--A notice required 
                under this paragraph shall include the following:
                            (i) With respect to the collection of 
                        covered data by a covered platform--
                                    (I) the type of data to be 
                                collected;
                                    (II) whether the collection of data 
                                will continue beyond the user's 
                                immediate use of the covered platform; 
                                and
                                    (III) how the data will be used by 
                                the covered platform.
                            (ii) With respect to the sale, sharing, or 
                        conveyance of covered data by a covered 
                        platform--
                                    (I) the specific data that will be 
                                sold, shared, or otherwise conveyed to 
                                a third party entity;
                                    (II) the name of any third party 
                                entity to which data will be sold, 
                                shared, or otherwise conveyed; and
                                    (III) the country of origin of the 
                                third party entity to which the data 
                                will be sold, shared, or conveyed.

SEC. 3. ENFORCEMENT.

    (a) Enforcement by the Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        this Act or a regulation promulgated under this Act shall be 
        treated as an unfair or deceptive act or practice in violation 
        of a rule promulgated under section 18(a)(1)(B) of the Federal 
        Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of the commission.--
                    (A) In general.--The Federal Trade Commission shall 
                enforce this Act and any regulation promulgated under 
                this Act in the same manner, by the same means, and 
                with the same jurisdiction, powers, and duties as 
                though all applicable terms and provisions of the 
                Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this Act.
                    (B) Privileges and immunities.--Any covered entity 
                who violates this Act or a regulation promulgated under 
                this Act shall be subject to the penalties and entitled 
                to the privileges and immunities provided in the 
                Federal Trade Commission Act (15 U.S.C. 41 et seq.).
    (b) Private Right of Action.--
            (1) In general.--An individual alleging a violation of this 
        Act may bring a civil action in any court of competent 
        jurisdiction, State or Federal.
            (2) Injury in fact.--A violation of this Act with respect 
        to the requirements to notify and obtain the express consent of 
        the user before the user's data may be collected, sold, shared, 
        or otherwise conveyed to a third-party entity constitutes a 
        concrete and particularized injury in fact to that individual.
            (3) Relief.--In a civil action brought under paragraph (1) 
        in which the plaintiff prevails, the court shall award--
                    (A) the greater of--
                            (i) not less than $5,000; and
                            (ii) actual damages; and
                    (B) reasonable attorney's fees and litigation 
                costs.
    (c) Rulemaking.--The Federal Trade Commission shall promulgate in 
accordance with section 553 of title 5, United States Code, such rules 
as may be necessary to carry out this Act.
                                 <all>