Consistent with the discretion afforded by the APA, Regulations.gov and agency-specific comment websites use required and optional fields on comment forms to collect some identity information from commenters. In addition to the text of the comment, agencies may choose to collect identity information by requiring commenters to fill in other fields, such as name, address, and email address before they are able to submit a comment. Regardless of the fields required by the comment form, the selected agencies all accept anonymous comments in practice. Specifically, in the comment forms on Regulations.gov and agency- specific comment websites, a commenter can submit under a fictitious name, such as “Anonymous Anonymous,” enter a single letter in each required field, or provide a fabricated address. In each of these scenarios, as long as a character or characters are entered into the required fields, the comment will be accepted. Further, because the APA does not require agencies to authenticate submitted identity information, neither Regulations.gov nor the agency-specific comment websites contain mechanisms to check the validity of identity information that commenters submit through comment forms. Regulations.gov and agency-specific comment websites also collect some information about public users’ interaction with their websites through application event logs and proxy server logs, though the APA does not require agencies to collect or verify it as part of the rulemaking process. This information, which can include a public user’s Internet Protocol (IP) address, browser type and operating system, and the time and date of webpage visits, is collected separately from the comment submission process as part of routine information technology management for system security and performance, and cannot be reliably connected to specific comments. Seven of the 10 selected agencies have documented some internal guidance associated with the identity of commenters during the three phases of the public comment process: intake, analysis, and response to comments. However, the focus and substance of this guidance varies by agency and phase of the comment process. As shown in Table 1, for selected agencies that have guidance associated with the identity of commenters, it most frequently relates to the comment intake or response to comment phases of the public comment process. The guidance for these phases addresses activities such as managing duplicate comments (those with identical or near-identical comment text but varied identity information) or referring to commenters in a final rule. Agencies are not required by the APA to develop internal guidance associated with the public comment process generally, or identity information specifically. Within the discretion afforded by the APA, the 10 selected agencies’ treatment of identity information varies during the three phases of the public comment process. Selected agencies differ in how they treat identity information during the comment intake phase, particularly in terms of how they post duplicate comments, which can lead to identity information being inconsistently presented to public users of comment systems. Generally, officials told us that their agencies either (1) maintain all comments within the comment system, or (2) maintain some duplicate comment records outside of the comment system, for instance, in email file archives. When an agency chooses to post a sample of duplicate comments, the identity information and unique comment contents for all duplicate comments may not be present on the public website. For example, for all duplicate comments received, Securities and Exchange Commission (SEC) posts a single example for each set of duplicate comments and indicates the total number of comments received. As a result, the identity information and any unique comment content beyond the first example are not present on the public website. (See fig. 1.) Selected agencies’ treatment of identity information during the comment analysis phase also varies. Specifically, program offices with the responsibility for analyzing comments place varied importance on identity information during the analysis phase. Finally, all agencies draft a response to comments with their final rule, but the extent to which the agencies identify commenters or commenter types in their response also varies across the selected agencies. Our analysis of Regulations.gov and agency-specific comment websites shows that the varied comment posting practices of the 10 selected agencies are not always documented or clearly communicated to public users of the websites. The E-Government Act of 2002 requires that all public comments and other materials associated with a given rulemaking should be made “publicly available online to the extent practicable.” In addition to the requirements of the E-Government Act, key practices for transparently reporting open government data state that federal government websites—like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. We found that the selected agencies we reviewed do not effectively communicate the limitations and inconsistencies in how they post identity information associated with public comments. As a result, public users of the comment websites lack information related to data availability and limitations that could affect their ability to use and make informed decisions about the comment data and effectively participate in the rulemaking process themselves. Public users of Regulations.gov seeking to submit a comment are provided with a blanket disclosure statement related to how their identity information may be disclosed, and are generally directed to individual agency websites for additional detail about submitting comments. While additional information is provided in the Privacy Notice, User Notice, and Privacy Impact Assessment for Regulations.gov, public users are not provided any further detail on Regulations.gov regarding what information, including identity information, they should expect to find in the comment data. Additionally, there is not enough information to help public users determine whether all of the individual comments and associated identity information are posted. Available resources on Regulations.gov direct public users to participating agencies’ websites for additional information about agency-specific review and posting policies. Seven of the eight participating agencies’ websites direct public users back to Regulations.gov and the Federal Register, either on webpages that are about the public comment process in general, or on pages containing information about specific NPRMs. Three of these participating agencies – the Environmental Protection Agency (EPA), the Fish and Wildlife Service (FWS), and the Food and Drug Administration (FDA) – do provide public users with information beyond directing them back to Regulations.gov or the Federal Register, but only FDA provides users with details about posting practices that are not also made available on Regulations.gov. The eighth participating agency – the Employee Benefits Security Administration (EBSA) – does not direct public users back to Regulations.gov, and instead recreates all rulemaking materials for each NPRM on its own website, including individual links to each submitted comment. However, these links go directly to comment files, and do not link to Regulations.gov. While EBSA follows departmental guidance associated with posting duplicate comments, which allows some discretion in posting practices, the agency does not have a policy for how comments are posted to Regulations.gov or its own website. Further, in the examples we reviewed, the content of the NPRM-specific pages on EBSA’s website does not always match what is posted to Regulations.gov. Because participating agencies are not required to adhere to standardized posting practices, Regulations.gov directs public users to participating agency websites for additional information about posting practices and potential data limitations. However, these websites do not describe the limitations associated with the identity information contained in publicly posted comments. As allowed for under the APA, all of the participating agencies in our review vary in the way in which they post identity information associated with comments—particularly duplicate comments. However, the lack of accompanying disclosures may potentially lead users to assume, for example, that only one entity has weighed in on an issue when, actually, that comment represents 500 comments. Without better information about the posting process, the inconsistency in the way in which duplicate comments are presented to public users of Regulations.gov limits public users’ ability to explore and use the data and could lead users to draw inaccurate conclusions about the public comments that were submitted and how agencies considered them during the rulemaking process. Both nonparticipating agencies use comment systems other than Regulations.gov and follow standardized posting processes associated with public comments submitted to their respective comment systems, but SEC has not clearly communicated these practices to the public. Although it appears to users of the SEC website that the agency follows a consistent process for posting duplicate comments, at the time of our June 2019 report, this practice had not been documented or communicated to public users of its website. In contrast, FCC identifies its policies for posting comments and their associated identity information in a number of places on the FCC.gov website, and on its Electronic Comment Filing System (ECFS) web page within the general website. Regarding comments submitted to rulemaking proceedings through ECFS, public users are informed that all information submitted with comments, including identity information, will be made public. Our review of ECFS comment data did not identify discrepancies with this practice. Although the public comment process allows interested parties to state their views about prospective rules, the lack of communication with the public about the way in which agencies treat identity information during the posting process, particularly for duplicate comments, may inhibit users’ meaningful participation in the rulemaking process. While the APA does not include requirements for commenters to provide identity information, or for agency officials to include commenters identity as part of their consideration of comments, key practices for transparently reporting open government data state that federal government websites— like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. As shown in Table 2, we recommended in our June 2019 report that five of the selected agencies establish a policy for posting comments, and that eight selected agencies take action to more clearly communicate their policies for posting comments, particularly with regard to identity information and duplicate comments. These agencies generally agreed with our recommendations and identified actions they planned to take in response, such as developing policies for posting duplicate comments and communicating those in various ways to public users. Since issuing our June 2019 report, all of the agencies to which we made recommendations have provided us with additional updates. Specifically, SEC completed actions that are responsive to the recommendation we made to it. In this regard, in September 2019, SEC issued a memorandum that reflects SEC’s internal policies for posting duplicate comments and associated identity information. SEC has also communicated these policies to public users on the SEC.gov website by adding a disclaimer on the main comment posting page that describes how the agency posts comments. These measures will help public users better determine whether and how they can use the data associated with public comments. The other seven agencies have provided updates, but have not yet implemented the recommendations. In December 2019 and January 2020, the Bureau of Land Management (BLM), Consumer Financial Protection Bureau (CFPB), EPA, and FWS notified us that they are in the process of developing or updating policies for posting public comments as well as statements for their websites to communicate these policies to the public. Similarly, in January 2020, the Department of Health and Human Services (HHS) stated that the Centers for Medicare and Medicaid Services (CMS) would update its comment posting policy and communicate it on the CMS website. However, the excerpt of the policy language provided does not include information about how the agency posts duplicate comments. Further, CMS did not provide us with the finalized policy, and our review of the website does not indicate any changes have been made. HHS officials stated they would provide additional follow up actions by July 2020. In September 2019, EBSA also stated that it will develop a written policy regarding posting of comments, including duplicate comments, which will be available on its website. However, the agency did not provide evidence that a formal evaluation of its current practice of replicating rulemaking dockets had been conducted, and did not identify plans to do so. The Wage and Hour Division (WHD) indicated that it will add text to each webpage for any rulemaking that invites public comments that states any personal information included in the comments (including duplicate) will be posted to Regulations.gov without change. However, the preliminary text provided by officials in August 2019 does not explain WHD’s policy of posting duplicate comments as a group under a single document ID, and therefore does not clearly communicate the agency’s posting practices to the public. Chairman Green, Ranking Member Barr, and Members of the Subcommittee, this concludes my prepared remarks. I would be happy to answer any questions you may have at this time. For further information regarding this testimony, please contact Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are David Bruno (Assistant Director), Allison Gunn (Analyst in Charge), Elizabeth Kowalewski, and Roger Gildersleeve. Individuals who contributed to the report on which this testimony is based include Enyinnaya David Aja, Gretel Clarke, Lauren Kirkpatrick, James Murphy, Alexandria Palmer, Carl Ramirez, Shana Wallace, and April Yeaney. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This testimony summarizes GAO's June 2019 report on public comment posting practices (GAO-19-483). In that report, GAO examined (1) the identity information collected by comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how 10 selected agencies treat identity information; and (4) the extent to which the selected agencies clearly communicate their practices associated with identity information. The 10 agencies were selected on the basis of the volume of public comments they received on rulemakings. For this testimony, GAO obtained updates on the status of recommendations made to the selected agencies. The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure below). In June 2019, GAO found that Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process, and all selected agencies accept anonymous comments in practice. GAO found in the June 2019 report that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance of this guidance varies. This reflects the differences in the way that the selected agencies handle commenter identity information internally. GAO also found that the selected agencies' practices for posting public comments to comment websites vary considerably, particularly for duplicate comments (identical or near-identical comment text but varied identity information). For example, one agency posts a single example of duplicate comments and indicates the total number of comments received, but only the example is available to public users of Regulations.gov. In contrast, other agencies post all comments individually. As a result, identity information submitted with comments is inconsistently presented on public websites. The APA allows agencies discretion in how they post comments, but GAO found that some of the selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. If not, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue. In June 2019, GAO made recommendations to eight of the selected agencies regarding implementing and communicating public comment posting policies. The agencies generally agreed with the recommendations and identified actions they planned to take in response. Since the June 2019 report, one agency has implemented GAO's recommendation and seven agencies have identified additional planned actions.