1. Short title
This Act may be cited as the “Deceptive Experiences To Online Users Reduction Act” or the “DETOUR Act”.
Deceptive Experiences To Online Users Reduction Act
A BILL
To prohibit the usage of exploitative and deceptive practices by large online operators and to promote consumer welfare in the use of behavioral research by such providers.
2. Definitions
In this Act the following definition apply:
Behavioral or psychological experiment, research, or study— The term behavioral or psychological experiment, research, or study means the study, including through human experimentation, of overt or observable actions and mental phenomena inferred from behavior, including interactions between and among individuals and the activities of social groups.
Commission— The term Commission means the Federal Trade Commission.
Compulsive usage— The term compulsive usage means any response stimulated by external factors that causes an individual to engage in repetitive, purposeful, and intentional behavior causing psychological distress, loss of control, anxiety, depression, or harmful stress responses.
Independent review board— The term independent review board means a board, committee, or other group that serves to protect the welfare, rights, and privacy of users and is formally designated by a large online operator to review, approve the initiation of, and conduct periodic review of, any behavioral or psychological experiment, research, or study, conducted by such an operator or by any entity directed by such an operator to conduct such behavioral or psychological experiment, research, or study, involving human subjects.
Informed consent— The term informed consent—
means the express, affirmative consent freely given by a user immediately prior to any user data being collected from such user for any behavioral or psychological experiment, research, or study, where such user is provided adequate and understandable information—
to allow for an informed decision about voluntary participation in such a behavioral or psychological experiment, research, or study; and
to ensure the understanding of such user of the information and any associated benefits, risks, or consequences of participation prior to obtaining the voluntary agreement to participate by the user; and
does not include—
the consent of an individual under the age of 18;
language that limits or purports to limit the liability of a large online operator; or
the consent to a provision contained in a general contract or service agreement.
Large online operator— The term large online operator means any person that—
provides an online service;
has more than 100,000,000 authenticated users of an online service in any 30-day period; and
is subject to the jurisdiction of the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Online service— The term online service means a website or interactive computer service, other than an internet access service, that is made available to the public over the internet and enables users to generate content that can be viewed by other users of the service or that connects users for the purpose of such users engaging in dialogue, sharing information, or otherwise interacting.
Parental consent— The term parental consent means the verifiable consent of a parent or guardian for a child under the age of 18 who uses an online service.
User— The term user means any individual who uses an online service.
User data— The term user data means any information relating to an identified or identifiable individual user, whether directly submitted to the large online operator by the user or derived from the observed activity of the user by the large online operator. Such term includes any such information purchased or otherwise obtained from third parties.
User interface— The term user interface refers to any content accessible to a user of an online service or means by which a user interacts with such online service or engages with other users of an online service.
Verifiable consent— The term verifiable consent means the express, affirmative consent freely given by a user to be subjected to the intended effect or effects of a user interface for an online service that is—
specific, informed, and unambiguous; and
given without the exchange of any financial or other incentives for such consent.
3. Unfair and deceptive acts and practices relating to the manipulation of user interfaces
Conduct prohibited—
In general— It shall be unlawful for any large online operator—
to design, modify, or manipulate a user interface of an online service with the purpose or substantial effect of obscuring, subverting, or impairing user autonomy, decision making, or choice to obtain consent or user data;
to conduct a behavioral or psychological experiment, research, or study of users of an online service, except with the informed consent of each user involved;
to design, modify, or manipulate a user interface of an online service with the purpose or substantial effect of cultivating compulsive usage, including video auto-play functions initiated without verifiable consent of a user; or
to design, modify, or manipulate a user interface on an online service, or portion thereof, that is directed to an individual under the age of 18, with the purpose or substantial effect of increasing usage of an online service through which a user interacts with other users without parental consent.
Duties of large online operators— Any large online operator that engages in any form of behavioral or psychological experiment, research, or study based on the activity or data of its users shall—
disclose, on a routine basis, but not less than once each 90 days, the general purpose of any such behavioral or psychological experiment, research, or study to each user whose user data is or was during the previous 90-day period subject to or included in any such behavioral or psychological experiment, research, or study;
state on its online platform and readily accessible to a user through its user interface, any behavioral or psychological experiment, research, or study whose purpose is to increase user engagement with the online service or to encourage users to take any action to convert such users into purchasers of any additional product or service offered by such online service;
present the disclosures described in paragraphs (1) and (2) in a manner that—
is clear, conspicuous, context-appropriate, and easily accessible; and
is not deceptively obscured;
discontinue any behavioral or psychological experiment, research, or study, if informed consent or parental consent was determined by such large online operator to be inappropriately acquired, or has reason to believe that such consent was inappropriately acquired, and cannot obtain such consent within 48 hours of such determination, for the processing of user data for behavioral or psychological experiment, research, or study;
establish an independent review board for any behavioral or psychological research, of any purpose, conducted on users or on the basis of user activity or data, which shall review and have authority to approve, require modification in, or disapprove all behavioral or psychological experiments, research, or studies; and
ensure that such independent review board established under paragraph (5) shall register with the Commission, including providing to the Commission—
the names and resumes of every board member;
the composition and reporting structure of the board to the management of the operator;
the process by which the board is to be notified of proposed studies or modifications along with the processes by which the board is capable of vetoing or amending such proposals;
any compensation provided to board members; and
any conflict of interest that might exist concerning a board member's participation in the board.
Registered professional standards body—
Registration— An association of large online operators may register as a professional standards body by filing with the Commission an application for registration in such form as the Commission, by rule, may prescribe containing the rules of the association and such other information and documents as the Commission, by rule, may prescribe as necessary or appropriate in the public interest or for protecting the welfare of users of large online operators.
Determination by the Commission— An association of large online operators may not register as a professional standards body unless the Commission determines that—
the association is so organized and has the capacity to enforce compliance by its members and persons associated with its members, with the provisions of this Act;
the rules of the association provide that any large online operator may become a member of such association;
the rules of the association assure a fair representation of its members in the selection of its directors and administration of its affairs and provide that one or more directors shall be representative of users and not be associated with, or receive any direct or indirect funding from, a member of the association or any large online operator;
the rules of the association are designed to prevent exploitative and manipulative acts or practices, to promote transparent and fair principles of technology development and design, to promote research in keeping with best practices for behavioral or psychological experiments, research, or studies or the designs of a user interfaces and informed consent, and to continually evaluate industry practices and issue binding guidance consistent with the objectives of this Act;
the rules of the association provide that its members and persons associated with its members shall be appropriately disciplined for violation of any provision of this Act, the rules or regulations thereunder, or the rules of the association, by expulsion, suspension, limitation of activities or functions, fine, censure, being suspended or barred from being associated with a member, or any other appropriate sanction; and
the rules of the association are in accordance with the provisions of this Act, and, in general, provide a fair procedure for the disciplining of members and persons associated with members, the denial of membership to any person seeking membership therein, the barring of any person from becoming associated with a member thereof, and the prohibition or limitation by the association of any person with respect to access to services offered by the association or a member thereof.
Responsibilities and activities— Any association registered under paragraph (1) shall develop, on a continuing basis, guidance and bright-line rules for the development and design of technology products of large online operators consistent with the duties of a large online operator described under subsection (b).
Enforcement by the Commission—
Unfair or deceptive acts or practice— A violation of subsection (a) or (b) shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Regulations— Not later than one year after the date of enactment of this Act, the Commission shall prescribe regulations under section 553 of title 5, United States Code, that—
establish rules and procedures for obtaining the informed consent, verifiable consent, or parental consent of users;
establish rules for the registration, formation, oversight, and management of the independent review boards, including standards that ensure effective independence of such entities from improper or undue influence by a large online operator;
establish rules for the registration, formation, oversight, and management of professional standards bodies, including procedures for the regular oversight of such bodies and revocation of their designation; and
in consultation with each professional standards body that registers under subsection (c), define conduct that does not have the purpose or substantial effect of subverting or impairing user autonomy, decision making, or choice, or of cultivating compulsive usage for users or increasing the usage of an online service by a child without parental consent, such as—
de minimis user interface changes derived from testing consumer preferences, including different styles, layouts, or text, where such changes are not done with the purpose of obtaining user consent or user data;
algorithms or data outputs outside the control of a large online operator or its affiliates; and
establishing default settings that provide enhanced privacy protection to users or otherwise enhance their autonomy and decision-making ability.