WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
This Act may be cited as the ''Data and Algorithm Transparency Agreement Act'' or the ''DATA Act''.
This section establishes the short title of the Act as the "Data and Algorithm Transparency Agreement Act" or the "DATA Act." It creates no compliance obligations.
(a) IN GENERAL.—Beginning 1 year after the date of enactment of this Act, any covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall comply with the requirements of subsection (c).
(b)(1) COVERED DATACovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1).—The term ''covered dataCovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1)'' means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.
(b)(2) COVERED PLATFORMCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2).—the term ''covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2)'' means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.
(c)(1) 1 NO COLLECTION OF COVERED DATACovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1) WITHOUT CONSENT.— (A) IN GENERAL.—A covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall not collect any covered data of an individual without obtaining the individual's express consent for such data collection. (B) REVOCATION OF CONSENT; RIGHT TO DELETE.—A covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall— (i) allow any individual to revoke or withdraw the individual's prior consent to the covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) collecting the individual's covered dataCovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1); and (ii) at the request of an individual, delete any covered data of the individual collected or held by the platform.
(c)(2) 2 NO SALE, SHARING, OR CONVEYANCE OF DATA WITHOUT CONSENT.— (A) IN GENERAL.—A covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall not sell, share, or otherwise convey to a third party entity any covered data of an individual without obtaining the individual's express consent. (B) REVOCATION OF CONSENT.—A covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall allow any individual to revoke or withdraw the individual's prior consent to any sale, sharing, or conveyance of the individual's covered dataCovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1).
(c)(3) 3 NOTICE OF REQUIREMENTS.— (A) IN GENERAL.—A covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) shall provide notice to users of the platform of the requirements described in paragraphs (1) and (2). (B) MANNER OF NOTIFICATION.—The notice required under subparagraph (A) shall contain the information described in subparagraph (C) and shall be provided by a covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2) to a user— (i) in plain language and in a conspicuous manner; (ii) in addition to any notice relating to the terms of service of the platform; (iii) each time the user logs in to the platform unless the user affirmatively waives receiving the notice; and (iv) each time the platform modifies its terms of service. (C) CONTENTS OF NOTIFICATION.—A notice required under this paragraph shall include the following: (i) With respect to the collection of covered dataCovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1) by a covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2)— (I) the type of data to be collected; (II) whether the collection of data will continue beyond the user's immediate use of the covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2); and (III) how the data will be used by the covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2). (ii) With respect to the sale, sharing, or conveyance of covered dataCovered dataThe term "covered data" means, with respect to an individual, data regarding the habits, traits, preferences, beliefs, or location of the individual.Sec. 2(b)(1) by a covered platformCovered platformThe term "covered platform" means a public-facing website, internet application, or mobile internet application, including a social network, video sharing service, ad network, mobile operating system, search engine, email service, or internet access service that— (A) has not less than 30,000,000 active monthly users in the United States; and (B) uses an algorithm to increase or decrease the availability of content on the website or application.Sec. 2(b)(2)— (I) the specific data that will be sold, shared, or otherwise conveyed to a third party entity; (II) the name of any third party entity to which data will be sold, shared, or otherwise conveyed; and (III) the country of origin of the third party entity to which the data will be sold, shared, or conveyed.
Section 2 is the operative heart of the bill. It defines two key terms — covered data (habits, traits, preferences, beliefs, or location data) and covered platform (public-facing websites and apps with 30 million+ U.S. monthly active users that use algorithms to manipulate content availability) — and then imposes three layered requirements on covered platforms.
The first requirement prohibits collecting any covered data without express consent and grants users a right to revoke consent and request deletion. The second mirrors this for data sharing: no sale, sharing, or conveyance to third parties without express consent, with a parallel revocation right. The third requires detailed, recurring notice — delivered each time a user logs in unless affirmatively waived, and again whenever terms of service change — disclosing specific information about what data is collected, how it will be used, what data will be shared, the identity of third-party recipients, and the country of origin of those recipients.
(a)(1)–(2) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of this Act or a regulation promulgated under this Act shall be treated as an unfair or deceptive act or practice in violation of a rule promulgated under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). (2) POWERS OF THE COMMISSION.— (A) IN GENERAL.—The Federal Trade Commission shall enforce this Act and any regulation promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. (B) PRIVILEGES AND IMMUNITIES.—Any covered entity who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
(b)(1)–(3) PRIVATE RIGHT OF ACTION.— (1) IN GENERAL.—An individual alleging a violation of this Act may bring a civil action in any court of competent jurisdiction, State or Federal. (2) INJURY IN FACT.—A violation of this Act with respect to the requirements to notify and obtain the express consent of the user before the user's data may be collected, sold, shared, or otherwise conveyed to a third-party entity constitutes a concrete and particularized injury in fact to that individual. (3) RELIEF.—In a civil action brought under paragraph (1) in which the plaintiff prevails, the court shall award— (A) the greater of— (i) not less than $5,000; and (ii) actual damages; and (B) reasonable attorney's fees and litigation costs.
(c) RULEMAKING.—The Federal Trade Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.
Section 3 establishes dual enforcement. The FTC treats violations as unfair or deceptive acts or practices under the FTC Act and enforces the bill using existing FTC powers, jurisdiction, and penalty authority. In parallel, the bill creates a private right of action: any individual alleging a violation may sue in state or federal court. The statute declares that a violation of the notice-and-consent requirements constitutes a concrete and particularized injury in fact — a notable legislative override of standing doctrine. Prevailing plaintiffs receive the greater of $5,000 or actual damages, plus reasonable attorney's fees and litigation costs. The FTC is also directed to promulgate implementing rules under APA notice-and-comment procedures.