[Congressional Record Volume 169, Number 119 (Wednesday, July 12, 2023)]
[Senate]
[Pages S2442-S2443]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 279. Mr. SCOTT of South Carolina submitted an amendment intended 
to be proposed by him to the bill S. 2226, to authorize appropriations 
for fiscal year 2024 for military activities of the Department of 
Defense, for military construction, and for defense activities of the 
Department of Energy, to prescribe military personnel strengths for 
such fiscal year, and for other purposes; which was ordered to lie on 
the table; as follows:

       At the end of title X, add the following:

                     Subtitle H--Know Your App Act

     SEC. 1091. SHORT TITLE.

       This subtitle may be cited as the ``Know Your App Act''.

     SEC. 1092. FINDINGS; SENSE OF CONGRESS.

       (a) Findings.--Congress finds the following:
       (1) Minors engaging with internet-linked applications face 
     heightened susceptibility to privacy risks and potential 
     exploitation through those applications. It is crucial for 
     parents and guardians to possess comprehensive knowledge 
     about the applications being accessed so that they can make 
     informed decisions to protect their children.
       (2) Many users are unaware of the country of origin of the 
     applications they download and use, as well as the data 
     handling practices of the developers behind those 
     applications. This lack of transparency can lead to potential 
     risks for users, including exposure to foreign government 
     surveillance, data breaches, and privacy violations. Users 
     have a right to know baseline information on the country of 
     origin so that they can personally make decisions to mitigate 
     the threat to their personal and biometric information.
       (3) The potential for foreign governments to access user 
     data through internet-linked applications presents national 
     security risks. These risks may include the collection of 
     sensitive information, espionage, and potential influence 
     over critical infrastructure.
       (4) Increasing transparency and providing users with the 
     necessary information to make informed decisions about the 
     applications they download can help protect consumer privacy 
     and security.
       (b) Sense of Congress.--It is the sense of Congress that 
     covered companies and developers already posses the 
     information necessary to provide adequate transparency to 
     consumers.

     SEC. 1093. PUBLIC LISTING OF COUNTRY OF ORIGIN OF 
                   APPLICATIONS.

       (a) Definitions.--In this section:
       (1) Application.--The term ``application'' means a software 
     application or electronic service that may be run or directed 
     by a user on a computer, a mobile device, or any other 
     general purpose computing device.
       (2) Application store.--The term ``application store'' 
     means a publicly available website, software application, 
     electronic service, or platform provided by a device 
     manufacturer that--
       (A) distributes applications from third-party developers to 
     users of a computer, a mobile device, or any other general 
     purpose computing device; and
       (B) has more than 20,000,000 users in the United States.
       (3) Application store page.--The term ``application store 
     page'' means the individual, dedicated listing page within an 
     application store that serves as the primary source of 
     information on a specific application and provides detailed 
     information about the application, including the name of the 
     application, the developer, a description, user ratings and 
     reviews, screenshots or previews, pricing, and system 
     requirements.
       (4) Assistant secretary.--The term ``Assistant Secretary'' 
     means the Assistant Secretary of Commerce for Communications 
     and Information.
       (5) Beneficial owner.--The term ``beneficial owner'' --
       (A) means, with respect to a developer of an application, 
     an individual who, directly or indirectly, through any 
     contract, arrangement, understanding, relationship, or 
     otherwise--
       (i) exercises substantial control over the developer; or
       (ii) owns or controls not less than 25 percent of the 
     ownership interests of the developer; and
       (B) does not include--
       (i) a minor child, as defined in the State in which the 
     entity is formed, if the information of the parent or 
     guardian of the minor child is reported in accordance with 
     this section;
       (ii) an individual acting as a nominee, intermediary, 
     custodian, or agent on behalf of another individual;
       (iii) an individual acting solely as an employee of a 
     corporation, limited liability company, or other similar 
     entity and whose control over or economic benefits from such 
     entity is derived solely from the employment status of the 
     individual;
       (iv) an individual whose only interest in a corporation, 
     limited liability company, or other similar entity is through 
     a right of inheritance; or
       (v) a creditor of a corporation, limited liability company, 
     or other similar entity, unless the creditor meets the 
     requirements of subparagraph (A).
       (6) Country of concern.--The term ``country of concern'' 
     means a country that is on the list described in section 
     1094.
       (7) Country of origin.--The term ``country of origin''--
       (A) with respect to the developer of an application, means 
     the country in which the developer is headquartered or 
     principally operates; and
       (B) with respect to the beneficial owner of the developer 
     of an application--
       (i) except as provided in clause (ii), means the country 
     from which the beneficial owner principally exercises control 
     over the developer; and
       (ii) if the beneficial owner exercises any control over the 
     developer from a country of concern, means that country.
       (8) Covered company.--The term ``covered company'' means 
     any person, entity, or organization that owns, controls, or 
     operates an application store that serves customers in the 
     United States.
       (9) Developer.--The term ``developer'' means a person that 
     creates, owns, or controls an application and is responsible 
     for the design, development, maintenance, and distribution of 
     the application to end users through an application store.
       (10) Primary country of origin.--The term ``primary country 
     of origin'', with respect to an application--
       (A) except as provided in subparagraph (B), means the 
     country of origin of the developer of the application; and
       (B) if the country of origin of the beneficial owner of the 
     developer of the application is a country of concern, means 
     that country.
       (11) Prominent display.--The term ``prominent display'', 
     with respect to an application store page, means a banner 
     that is immediately and clearly visible when the application 
     store page is accessed.
       (b) Requirements.--
       (1) Public listing.--The Assistant Secretary shall require 
     a covered company to publicly list, in a prominent display on 
     the application store page, the primary country of origin of 
     each application distributed through an application store 
     owned, controlled, or operated by the covered company.
       (2) Protections regarding certain foreign countries.--
       (A) Filter for certain applications.--The Assistant 
     Secretary shall require a covered company to provide users of 
     the covered company's application store with the option to 
     filter out applications whose primary country of origin is a 
     country of concern.
       (B) Disclaimer for certain applications.--The Assistant 
     Secretary shall require that if the primary country of origin 
     of an application is a country of concern, a covered company 
     that distributes the application through an application store 
     shall provide a disclaimer, in a prominent display on the 
     application store page, that data from the application could 
     be accessed by a foreign government.
       (3) Update of information.--
       (A) In general.--The Assistant Secretary shall require a 
     developer to notify a covered company whose application store 
     distributes the developer's application of any change in--
       (i) the country of origin of the developer;
       (ii) the beneficial owner of the developer; or
       (iii) the country of origin of the beneficial owner of the 
     developer.
       (B) Developer certification.--
       (i) In general.--The Assistant Secretary shall require a 
     developer to certify to each covered company that owns, 
     controls, or operates an application store through which the 
     developer's application is distributed, not less frequently 
     than annually, that the information displayed on the 
     application

[[Page S2443]]

     store page with respect to the application, including primary 
     country of origin and beneficial ownership, is up-to-date.
       (ii) Violations.--If a developer violates clause (i)--

       (I) the covered company shall issue the developer a series 
     of not fewer than 3 warnings over a period of not more than 
     90 days; and
       (II) if the developer does not correct the violation by the 
     date that is 90 days after the date on which the first 
     warning is issued under subclause (I), the covered company 
     shall remove the application of the developer from the 
     application store.

       (4) Reporting mechanism.--The Assistant Secretary shall 
     require a covered company to establish a mechanism that--
       (A) allows a user of the covered company's application 
     store, an employee of a developer whose application is 
     distributed through the covered company's application store, 
     or an associated third party to report a potential violation 
     of this subsection by a developer, including incorrect 
     information displayed on the application store page; and
       (B) allows a report under subparagraph (A) to be made 
     anonymously.
       (5) Written policy for appeals of removals.--The Assistant 
     Secretary shall require a covered company to establish, for 
     any application store owned, controlled, or operated by the 
     covered company, a clear written policy for how a developer 
     can appeal the removal of an application from the application 
     store and have the application be reinstated.

     SEC. 1094. LIST OF FOREIGN COUNTRIES WITH NATIONAL LAWS 
                   RESULTING IN GOVERNMENT CONTROL OVER 
                   APPLICATIONS.

       (a) In General.--Not later than 180 days after the date of 
     enactment of this Act, and annually thereafter, the Secretary 
     of the Treasury and the Secretary of Commerce shall jointly 
     develop and submit to Congress a list of each foreign country 
     that has in effect a national law that may subject a 
     developer or application to control by the government of the 
     country over content moderation, algorithm design, or user 
     data transfers.
       (b) Publication.--With respect to the list developed under 
     subsection (a)--
       (1) the Secretary of the Treasury shall make the list 
     publicly available on the website of the Department of the 
     Treasury; and
       (2) the Secretary of Commerce shall make the list publicly 
     available on the website of the Department of Commerce.

     SEC. 1095. LIMITATION OF ENFORCEMENT AND REGULATION.

       The Assistant Secretary of Commerce for Communications and 
     Information may not exercise any enforcement authority or 
     regulatory authority over a covered company or developer that 
     is not provided under this subtitle, including through 
     rulemaking.

     SEC. 1096. ENFORCEMENT.

       The Attorney General may bring a civil action in an 
     appropriate district court of the United States against any 
     covered company that violates this subtitle.
                                 ______