This bill requires most commercial websites and online services to publish a short, truthful, and non-misleading terms-of-service summary and a graphic data-flow diagram. It also requires the full terms to be available in an interactive, machine-readable format. The Federal Trade Commission (the Commission) must issue rules and guidance within 360 days after the law is enacted that specify the format and content.
The required summary must be accessible to people with low literacy and people with disabilities, be machine readable, and may include tables, icons, hyperlinks, or other features. The summary must appear at the top of the permanent terms-of-service page, with the graphic data-flow diagram immediately below. The summary must list categories of sensitive information the service processes; say what sensitive information is required for basic service versus for extra or future features; summarize legal liabilities and rights users give up (for example, mandatory arbitration, class-action waivers, licensing or sale of user content, and waiver of moral rights); provide historical versions and change logs; give directions for deleting sensitive information when deletion is offered; list consumer-facing data breaches reported in the prior three years; and state the total word count and approximate time to read the full terms. The Commission will also list any other necessary information to include.
The bill defines covered entities as persons operating internet websites or online services for commercial purposes, excluding small businesses under the Small Business Act. The Commission will publish guidelines for how to show graphically how sensitive user information is shared with affiliates and third parties. The interactive data format must tag parts of the terms using a standard like XML. Violations are treated as unfair or deceptive acts under the Federal Trade Commission Act and are enforced by the Commission. State attorneys general may bring civil actions on behalf of at least 1,000 residents, with notice to the Commission and limited rules about intervention and venue.
The bill lists specific categories of "sensitive information," including health information; biometric data; precise geolocation; social security number; race, color, religion, national origin, sex, age, or disability; content and parties to a communication; audio and video recordings from consumer devices; financial account and card numbers; and online browsing history that shows activities over time or across other sites.
If you are a user of a commercial website or online service covered by this bill, you should be able to see a short, plain-language summary at the top of the service's permanent terms-of-service page. The summary will show what types of sensitive information the service collects or uses, what is required for the service to work, how to delete information (if deletion is offered), recent breach reports, and how long it would take to read the full terms. You will also see a graphic that explains how your sensitive information is shared.
If you operate a covered website or online service (and you are not a small business as defined by the Small Business Act), you will need to follow rules the FTC issues within 360 days of enactment to create the summary, the data-flow diagram, and the interactive tagged terms. The bill requires the summary to be accessible and machine readable.
No publicly available information on cost estimates or budgetary impacts is included in the bill text. The bill does specify enforcement under the Federal Trade Commission Act but does not state monetary penalties or compliance cost estimates.
No publicly available information on proponents' statements or arguments is included in the bill text provided.
No publicly available information on opponents' statements or arguments is included in the bill text provided.