II 116th CONGRESS 2d Session S. 4669 IN THE SENATE OF THE UNITED STATES September 23, 2020 Mr. Scott of Florida (for himself and Ms. Cortez Masto ) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require sellers of internet applications to disclose country-of-origin information, and for other purposes.

1. Short title This Act may be cited as the American Privacy Protection Act or the APP Act . 2. Definitions In this Act: (1) Commission The term Commission means the Federal Trade Commission. (2) Internet application The term internet application means a computer program or software application that is downloaded by a user to an internet-connected device. 3. Country of origin disclosure requirements for sellers of internet applications (a) In general Beginning on the date that is 180 days after the date of the promulgation of final regulations implementing this section— (1) it shall be unlawful for any person to sell or distribute an internet application unless the person discloses to any individual who downloads such application, in a clear and conspicuous manner and in the same language that is used on the rest of the platform on which such application is sold or distributed— (A) the business name and address of the owner of the application, the developer of the application, and any parent company of such owner or developer; (B) if more than 5 percent of the application was developed outside of the United States, each location in which the application was developed; and (C) each location, if any, outside of the United States in which data collected by the application is stored; and (2) it shall be unlawful for the owner or developer of an internet application to knowingly provide false information to a seller or distributor of internet applications with respect to any of the information described in paragraph (1). (b) Continuing notification requirement (1) In general A person shall not be considered to meet the requirement of paragraph (1) unless the person provides an individual with notice whenever the person has actual knowledge that— (A) a prior notice given to the individual under paragraph (1) regarding an internet application was incomplete or inaccurate with respect to the information described in subparagraph (B) or (C) of such paragraph; or (B) the location where the internet application is developed or stores data has changed so that the information provided under a prior notice given to the individual is incomplete or inaccurate with respect to the information described in subparagraph (B) or (C) of paragraph (1). (2) Timing A notice required under paragraph (1) shall be provided by a person not later than 2 days after the earliest date on which the person had actual knowledge described in such paragraph. (c) Safe harbor In complying with the requirement of subsection (a)(1) and subsection (b), the seller or distributor of an internet application may reasonably rely on representations made by the owner or developer of such application regarding the information described in subparagraphs (A) through (C) of subsection (a)(1). 4. Enforcement (a) Unfair and deceptive acts or practices A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (b) Powers of Commission (1) In general The Commission shall enforce this Act and any regulation promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (2) Privileges and immunities Any person that violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.). (c) Enforcement by State attorneys general In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates this Act or a regulation prescribed under this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to— (1) enjoin that practice; (2) enforce compliance with this Act or such regulation; (3) obtain damages, restitution, or other compensation on behalf of residents of the State; or (4) obtain such other relief as the court may consider to be appropriate. (d) Rulemaking The Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.