,,ii  #aafth ,,congress  #ast ,session  
,s4 #ahi  ,,in ,,the ,,senate ,,of ,,the
 ,,united ,,states  ,january #ag1       
#bjai,ms4 ,klobuchar 7for herself and   
,mr4 ,kennedy7 introduced the following 
bill2 which was read twice and referred 
to the ,committee on ,commerce1         
,science1 and ,transportation  ,a ,,bill
  ,to protect the privacy of users of   
social media and other online platforms4
  #a4 ,short title ,this ,act may be    
cited as the ,social ,media ,privacy    
,protection and ,consumer ,rights ,act  
of #bjai4  #b4 ,definitions ,in this    
,act--  7#a7 the term ,commission means 
the ,federal ,trade ,commission2  7#b7  
the term covered online platform means  
an online platform that collects        
personal data during the online behavior
 of a user of the online platform2  7#c7
 the term geolocation information means1
 with respect to an individual1 any     
information that is not the content of a
 communication1 concerning the location 
of a wireless communication device      

that--  7,a7 in whole or in part1 is    
generated by or derived from the        
operation of that device2 and  7,b7     
could be used to determine or infer     
information regarding the location of   
the individual2  7#d7 the term online   
platform-- 7,a7 means any public-facing 
website1 web application1 or digital    
application 7including a mobile         
application72 and  7,b7 includes a      
social network1 an ad network1 a mobile 
operating system1 a search engine1 an   
email service1 or an internet access    
service2  7#e7 the term operator has the
 meaning given the term in section #acjb
 of the ,children's ,online ,privacy    
,protection ,act of #aiih 7#ae ,u4,s4,c4
 #feja72 and  7#f7 the term personal    
data means individually identifiable    
information about an individual         
collected online1 including-- 7,a7      
location information sufficient to      
identify the name of a street and a city
 or town1 including a physical address2 
7,b7 an email address2  7,c7 a telephone

 number2  7,d7 a government identifier1 
such as a ,social ,security number2     
7,e7 geolocation information2  7,f7 the 
content of a message2  7,g7 protected   
health information1 as defined in       
section #afj4ajc of title #de1 ,code of 
,federal ,regulations1 or any successor 
regulation2 and  7,h7 nonpublic personal
 information1 as defined in section #eji
 of the ,gramm-,leach-,bliley ,act 7#ae 
,u4,s4,c4 #fhji74  #c4 ,privacy         
protections  7a7 ,transparency and terms
 of service  7#a7 ,disclosure and       
obtaining initial consent and privacy   
preferences  7,a7 ,in general ,before a 
user creates an account with1 or        
otherwise begins to use1 a covered      
online platform1 the operator of the    
online platform shall--  7i7 inform the 
user that1 unless the user makes an     
election under clause 7ii77,,ii71       
personal data of the user produced      
during the online behavior of the user1 
whether on the online platform or       
otherwise1 will be collected and used by

 the operator and third parties2 and    
7ii7 provide the user the option to     
specify the privacy preferences of the  
user1 including by-- 7,i7 agreeing to   
the terms of service for use of the     
online platform1 including1 except as   
provided in subclause 7,,ii71 the       
collection and use of personal data     
described in clause 7i72 and  7,,ii7    
prohibiting1 if the user so elects1 the 
collection and use of personal data     
described in clause 7i71 subject to     
subparagraph 7,b74  7,b7 ,consequence of
 prohibition of data collection ,if the 
election of a user under subparagraph   
7,a77ii77,,ii7 creates inoperability in 
the online platform1 the operator of the
 online platform may deny certain       
services or completely deny access to   
the user4  7,c7 ,form of disclosure ,an 
operator of a covered online platform   
shall provide a user of the online      
platform with the terms of service for  
use of the online platform1 including   
the collection and use of personal data 

described in subparagraph 7,a77i71 in a 
form that--  7i7 is-- 7,i7 easily       
accessible2  7,,ii7 of reasonable       
length2 and  7,,iii7 clearly            
distinguishable from other matters2 and 
7ii7 uses language that is clear1       
concise1 and well organized1 and follows
 other best practices appropriate to the
 subject and intended audience4  7,d7   
,privacy or security program ,an        
operator of a covered online platform   
shall-- 7i7 establish and maintain a    
privacy or security program for the     
online platform2 and  7ii7 publish a    
description of the privacy or security  
program that-- 7,i7 details how the     
operator will use the personal data of a
 user of the online platform1 including 
requirements for how the operator will  
address privacy risks associated with   
the development of new products and     
services2 and  7,,ii7 includes details  
of the access that employees and        
contractors of the operator have to the 
personal data of a user of the online   

platform1 and internal policies for the 
use of that personal data4  7#b7 ,new   
products2 changes to privacy or security
 program ,an operator of a covered      
online platform may not introduce a new 
product1 or implement any material      
change to the privacy or security       
program of the online platform that     
overrides the privacy preferences of a  
user of the online platform1 as         
specified under paragraph 7#a77;,a77ii71
 unless the operator has--  7,a7        
informed the user that the new product  
or change will result in the collection 
and use of personal data described in   
paragraph 7#a77;,a77i71 if that is the  
case2  7,b7 provided the user the option
 under paragraph 7#a77;,a77ii72 and     
7,c7 obtained affirmative express       
consent from the user to the            
introduction of the new product or the  
implementation of the change4  7#c7     
,withdrawal of consent ,an operator of a
 covered online platform shall ensure   
that-- 7,a7 a user of the online        

platform is able to withdraw consent to 
the terms of service for use of the     
online platform1 including the          
collection and use of personal data     
described in paragraph 7#a77;,a77i71 as 
easily as the user is able to give such 
consent2 and  7,b7 except as otherwise  
required by law1 no person is able to   
access the personal data of a user of   
the online platform later than #cj days 
after the date on which the user closes 
his or her account or otherwise         
terminates his or her use of the online 
platform4  7b7 ,right to access ,an     
operator of a covered online platform   
shall offer a user of the online        
platform a copy of the personal data of 
the user that the operator has          
processed1 free of charge and in an     
electronic and easily accessible format1
 including a list of each person that   
received the personal data from the     
operator for business purposes1 whether 
through sale or other means4  7c7       
,violations of privacy  7#a7 ,in general

 ,not later than #gb hours after an     
operator of a covered online platform   
becomes aware that the personal data of 
a user of the online platform has been  
transmitted in violation of the privacy 
or security program of the online       
platform1 including the privacy         
preferences specified by the user under 
subsection 7a77#a77;,a77ii71 the        
operator shall--  7,a7 notify the user  
of the transmission2  7,b7 offer the    
user the option to elect to prohibit the
 operator from collecting and using the 
personal data of the user1 subject to   
paragraph 7#b72  7,c7 except as provided
 in paragraph 7#c71 offer the user the  
option to have the operator-- 7i7 erase 
all personal data of the user tracked by
 the operator2 and  7ii7 cease further  
dissemination of personal data of the   
user tracked by the operator2  7,d7     
offer the user a copy of the personal   
data of the user that the operator has  
processed1 free of charge and in an     
electronic and easily accessible format1

 including a list of each person that   
received the personal data from the     
operator1 whether through sale or other 
means2 and  7,e7 offer the user the     
option to close his or her account or   
otherwise terminate his or her use of   
the online platform4  7#b7 ,consequence 
of prohibition of data collection ,if   
the election of a user under paragraph  
7#a77;,b7 creates inoperability in the  
online platform1 the operator of the    
online platform may deny certain        
services or completely deny access to   
the user4  7#c7 ,public safety exception
 ,if the operator of a covered online   
platform1 in good faith1 believes that  
an emergency involving danger of death  
or serious physical injury to any       
individual requires disclosure without  
delay of specific personal data of a    
user of the online platform that relates
 to the emergency1 the operator shall-- 
7,a7 retain the specific personal data2 
and  7,b7 notify the proper authorities4
  7d7 ,compliance ,not less frequently  

than once every #b years1 the operator  
of a covered online platform shall audit
 the privacy or security program of the 
online platform4  7e7 ,safe harbor      
,subsections 7a71 7b71 and 7c7 shall not
 apply with respect to the development  
of privacy-enhancing technology by an   
operator of an online platform4  #d4    
,enforcement  7a7 ,enforcement by       
,commission  7#a7 ,unfair or deceptive  
acts or practices ,a violation of       
section #c shall be treated as a        
violation of a rule defining an unfair  
or deceptive act or practice prescribed 
under section #ah7;a77#a77;,b7 of the   
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #eg;a7a77#a77;,b774  7#b7     
,powers of ,commission  7,a7 ,in general
 ,except as provided in subparagraph    
7,c71 the ,commission shall enforce this
 ,act in the same manner1 by the same   
means1 and with the same jurisdiction1  
powers1 and duties as though all        
applicable terms and provisions of the  
,federal ,trade ,commission ,act 7#ae   

,u4,s4,c4 #da et seq47 were incorporated
 into and made a part of this ,act4     
7,b7 ,privileges and immunities ,except 
as provided in subparagraph 7,c71 any   
person who violates this ,act shall be  
subject to the penalties and entitled to
 the privileges and immunities provided 
in the ,federal ,trade ,commission ,act 
7#ae ,u4,s4,c4 #da et seq474  7,c7      
,common carriers and nonprofit          
organizations ,notwithstanding section  
#d1 #e7;a77#b71 or #f of the ,federal   
,trade ,commission ,act 7#ae ,u4,s4,c4  
#dd1 #de7;a77#b71 #df7 or any           
jurisdictional limitation of the        
,commission1 the ,commission shall also 
enforce this ,act1 in the same manner   
provided in subparagraphs 7,a7 and 7,b7 
of this paragraph1 with respect to--    
7i7 common carriers subject to the      
,communications ,act of #aicd 7#dg      
,u4,s4,c4 #aea et seq47 and ,acts       
amendatory thereof and supplementary    
thereto2 and  7ii7 organizations not    
organized to carry on business for their

 own profit or that of their members4   
7,d7 ,authority preserved ,nothing in   
this ,act shall be construed to limit   
the authority of the ,commission under  
any other provision of law4  7b7        
,enforcement by ,states  7#a7           
,authorization ,subject to paragraph    
7#b71 in any case in which the attorney 
general of a ,state has reason to       
believe1 based on a legitimate consumer 
complaint1 that an interest of the      
residents of the ,state has been or is  
threatened or adversely affected by the 
engagement of any person subject to     
section #c in a practice that violates  
that section1 the attorney general of   
the ,state may1 as parens patriae1 bring
 a civil action on behalf of the        
residents of the ,state in an           
appropriate district court of the       
,united ,states to obtain appropriate   
relief4  7#b7 ,rights of ,federal ,trade
 ,commission  7,a7 ,notice to ,federal  
,trade ,commission  7i7 ,in general     
,except as provided in clause 7iii71 the

 attorney general of a ,state shall     
notify the ,commission in writing that  
the attorney general intends to bring a 
civil action under paragraph 7#a7 before
 initiating the civil action against a  
person described in subsection 7a77#a74 
7ii7 ,contents ,the notification        
required by clause 7i7 with respect to a
 civil action shall include a copy of   
the complaint to be filed to initiate   
the civil action4  7iii7 ,exception ,if 
it is not feasible for the attorney     
general of a ,state to provide the      
notification required by clause 7i7     
before initiating a civil action under  
paragraph 7#a71 the attorney general    
shall notify the ,commission immediately
 upon instituting the civil action4     
7,b7 ,intervention by ,federal ,trade   
,commission ,the ,commission may-- 7i7  
intervene in any civil action brought by
 the attorney general of a ,state under 
paragraph 7#a7 against a person         
described in subsection 7a77#a72 and    
7ii7 upon intervening-- 7,i7 be heard on

 all matters arising in the civil       
action2 and  7,,ii7 file petitions for  
appeal of a decision in the civil       
action4  7#c7 ,investigatory powers     
,nothing in this subsection may be      
construed to prevent the attorney       
general of a ,state from exercising the 
powers conferred on the attorney general
 by the laws of the ,state to conduct   
investigations1 to administer oaths or  
affirmations1 or to compel the          
attendance of witnesses or the          
production of documentary or other      
evidence4  7#d7 ,action by ,federal     
,trade ,commission ,if the ,federal     
,trade ,commission institutes a civil   
action or an administrative action with 
respect to a violation of section #c1   
the attorney general of a ,state may    
not1 during the pendency of the action1 
bring a civil action under paragraph    
7#a7 against any defendant named in the 
complaint of the ,commission for the    
violation with respect to which the     
,commission instituted such action4     

7#e7 ,venue2 service of process  7,a7   
,venue ,any action brought under        
paragraph 7#a7 may be brought in-- 7i7  
the district court of the ,united       
,states that meets applicable           
requirements relating to venue under    
section #acia of title #bh1 ,united     
,states ,code2 or  7ii7 another court of
 competent jurisdiction4  7,b7 ,service 
of process ,in an action brought under  
paragraph 7#a71 process may be served in
 any district in which the defendant--  
7i7 is an inhabitant2 or  7ii7 may be   
found4  7#f7 ,actions by other ,state   
officials  7,a7 ,in general ,in addition
 to civil actions brought by attorneys  
general under paragraph 7#a71 any other 
consumer protection officer of a ,state 
who is authorized by the ,state to do so
 may bring a civil action under         
paragraph 7#a71 subject to the same     
requirements and limitations that apply 
under this subsection to civil actions  
brought by attorneys general4  7,b7     
,savings provision ,nothing in this     

subsection may be construed to prohibit 
an authorized official of a ,state from 
initiating or continuing any proceeding 
in a court of the ,state for a violation
 of any civil or criminal law of the    
,state4  #e4 ,effective date  7a7 ,in   
general ,this ,act shall take effect    
#ahj days after the date of enactment of
 this ,act4  7b7 ,applicability to      
existing users of online platforms ,an  
individual who becomes a user of a      
covered online platform before the      
effective date under subsection 7a7     
shall be treated as if he or she had    
become a user of the online platform on 
that effective date4  7c7 ,no           
retroactive applicability ,this ,act    
shall not apply to any conduct that     
occurred before the effective date under
 subsection 7a74