Section 1 Short title
This Act may be cited as the “Data and Algorithm Transparency Agreement Act” or the “DATA Act”.
Data and Algorithm Transparency Agreement Act
A BILL
To impose notice and consent requirements on internet platforms that use algorithms to manipulate the availability of content on the platform.
Sec. 2 Notice and consent requirements for internet platforms that use algorithms to manipulate the availability of platform content
In general— Beginning 1 year after the date of enactment of this Act, any covered platform shall comply with the requirements of subsection (c).
Definitions— In this Act:
Covered data— The term covered data means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.
Covered platform— the term covered platform means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that—
has not less than 30,000,000 active monthly users in the United States; and
uses an algorithm to increase or decrease the availability of content on the website or application.
Requirements—
No collection of covered data without consent—
In general— A covered platform shall not collect any covered data of an individual without obtaining the individual's express consent for such data collection.
Revocation of consent; right to delete— A covered platform shall—
allow any individual to revoke or withdraw the individual's prior consent to the covered platform collecting the individual's covered data; and
at the request of an individual, delete any covered data of the individual collected or held by the platform.
No sale, sharing, or conveyance of data without consent—
In general— A covered platform shall not sell, share, or otherwise convey to a third party entity any covered data of an individual without obtaining the individual's express consent.
Revocation of consent— A covered platform shall allow any individual to revoke or withdraw the individual's prior consent to any sale, sharing, or conveyance of the individual's covered data.
Notice of requirements—
In general— A covered platform shall provide notice to users of the platform of the requirements described in paragraphs (1) and (2).
Manner of notification— The notice required under subparagraph (A) shall contain the information described in subparagraph (C) and shall be provided by a covered platform to a user—
in plain language and in a conspicuous manner;
in addition to any notice relating to the terms of service of the platform;
each time the user logs in to the platform unless the user affirmatively waives receiving the notice; and
each time the platform modifies its terms of service.
Contents of notification— A notice required under this paragraph shall include the following:
With respect to the collection of covered data by a covered platform—
the type of data to be collected;
whether the collection of data will continue beyond the user's immediate use of the covered platform; and
how the data will be used by the covered platform.
With respect to the sale, sharing, or conveyance of covered data by a covered platform—
the specific data that will be sold, shared, or otherwise conveyed to a third party entity;
the name of any third party entity to which data will be sold, shared, or otherwise conveyed; and
the country of origin of the third party entity to which the data will be sold, shared, or conveyed.
Sec. 3 Enforcement
Enforcement by the Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of this Act or a regulation promulgated under this Act shall be treated as an unfair or deceptive act or practice in violation of a rule promulgated under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Powers of the commission—
In general— The Federal Trade Commission shall enforce this Act and any regulation promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Any covered entity who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Private right of action—
In general— An individual alleging a violation of this Act may bring a civil action in any court of competent jurisdiction, State or Federal.
Injury in fact— A violation of this Act with respect to the requirements to notify and obtain the express consent of the user before the user’s data may be collected, sold, shared, or otherwise conveyed to a third-party entity constitutes a concrete and particularized injury in fact to that individual.
Relief— In a civil action brought under paragraph (1) in which the plaintiff prevails, the court shall award—
the greater of—
not less than $5,000; and
actual damages; and
reasonable attorney’s fees and litigation costs.
Rulemaking— The Federal Trade Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.