[Congressional Record Volume 170, Number 120 (Wednesday, July 24, 2024)]
[Senate]
[Pages S5405-S5406]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 3091. Mr. SCOTT of South Carolina submitted an amendment intended
to be proposed by him to the bill S. 2073, to amend title 31, United
States Code, to require agencies to include a list of outdated or
duplicative reporting requirements in annual budget justifications, and
for other purposes; which was ordered to lie on the table; as follows:
At the end, add the following:
DIVISION B--KNOW YOUR APP ACT
SEC. 1001. SHORT TITLE.
This division may be cited as the ``Know Your App Act''.
SEC. 1002. FINDINGS; SENSE OF CONGRESS.
(a) Findings.--Congress finds the following:
(1) Minors engaging with internet-linked applications face
heightened susceptibility to privacy risks and potential
exploitation through those applications. It is crucial for
parents and guardians to possess comprehensive knowledge
about the applications being accessed so that they can make
informed decisions to protect their children.
(2) Many users are unaware of the country of origin of the
applications they download and use, as well as the data
handling practices of the developers behind those
applications. This lack of transparency can lead to potential
risks for users, including exposure to foreign government
surveillance, data breaches, and privacy violations. Users
have a right to know baseline information on the country of
origin so that they can personally make decisions to mitigate
the threat to their personal and biometric information.
(3) The potential for foreign governments to access user
data through internet-linked applications presents national
security risks. These risks may include the collection of
sensitive information, espionage, and potential influence
over critical infrastructure.
(4) Increasing transparency and providing users with the
necessary information to make informed decisions about the
applications they download can help protect consumer privacy
and security.
(b) Sense of Congress.--It is the sense of Congress that
covered companies and developers already posses the
information necessary to provide adequate transparency to
consumers.
SEC. 1003. PUBLIC LISTING OF COUNTRY OF ORIGIN OF
APPLICATIONS.
(a) Definitions.--In this section:
(1) Application.--The term ``application'' means a software
application or electronic service that may be run or directed
by a user on a computer, a mobile device, or any other
general purpose computing device.
(2) Application store.--The term ``application store''
means a publicly available website, software application,
electronic service, or platform provided by a device
manufacturer that--
(A) distributes applications from third-party developers to
users of a computer, a mobile device, or any other general
purpose computing device; and
(B) has more than 20,000,000 users in the United States.
(3) Application store page.--The term ``application store
page'' means the individual, dedicated listing page within an
application store that serves as the primary source of
information on a specific application and provides detailed
information about the application, including the name of the
application, the developer, a description, user ratings and
reviews, screenshots or previews, pricing, and system
requirements.
(4) Assistant secretary.--The term ``Assistant Secretary''
means the Assistant Secretary of Commerce for Communications
and Information.
(5) Beneficial owner.--The term ``beneficial owner'' --
(A) means, with respect to a developer of an application,
an individual who, directly or indirectly, through any
contract, arrangement, understanding, relationship, or
otherwise--
(i) exercises substantial control over the developer; or
(ii) owns or controls not less than 25 percent of the
ownership interests of the developer; and
(B) does not include--
(i) a minor child, as defined in the State in which the
entity is formed, if the information of the parent or
guardian of the minor child is reported in accordance with
this section;
(ii) an individual acting as a nominee, intermediary,
custodian, or agent on behalf of another individual;
(iii) an individual acting solely as an employee of a
corporation, limited liability company, or other similar
entity and whose control over or economic benefits from such
entity is derived solely from the employment status of the
individual;
(iv) an individual whose only interest in a corporation,
limited liability company, or other similar entity is through
a right of inheritance; or
(v) a creditor of a corporation, limited liability company,
or other similar entity, unless the creditor meets the
requirements of subparagraph (A).
(6) Country of concern.--The term ``country of concern''
means a country that is on the list described in section
1004.
(7) Country of origin.--The term ``country of origin''--
(A) with respect to the developer of an application, means
the country in which the developer is headquartered or
principally operates; and
(B) with respect to the beneficial owner of the developer
of an application--
(i) except as provided in clause (ii), means the country
from which the beneficial owner principally exercises control
over the developer; and
(ii) if the beneficial owner exercises any control over the
developer from a country of concern, means that country.
(8) Covered company.--The term ``covered company'' means
any person, entity, or organization that owns, controls, or
operates an application store that serves customers in the
United States.
(9) Developer.--The term ``developer'' means a person that
creates, owns, or controls an application and is responsible
for the design, development, maintenance, and distribution of
the application to end users through an application store.
[[Page S5406]]
(10) Primary country of origin.--The term ``primary country
of origin'', with respect to an application--
(A) except as provided in subparagraph (B), means the
country of origin of the developer of the application; and
(B) if the country of origin of the beneficial owner of the
developer of the application is a country of concern, means
that country.
(11) Prominent display.--The term ``prominent display'',
with respect to an application store page, means a banner
that is immediately and clearly visible when the application
store page is accessed.
(b) Requirements.--
(1) Public listing.--The Assistant Secretary shall require
a covered company to publicly list, in a prominent display on
the application store page, the primary country of origin of
each application distributed through an application store
owned, controlled, or operated by the covered company.
(2) Protections regarding certain foreign countries.--
(A) Filter for certain applications.--The Assistant
Secretary shall require a covered company to provide users of
the covered company's application store with the option to
filter out applications whose primary country of origin is a
country of concern.
(B) Disclaimer for certain applications.--The Assistant
Secretary shall require that if the primary country of origin
of an application is a country of concern, a covered company
that distributes the application through an application store
shall provide a disclaimer, in a prominent display on the
application store page, that data from the application could
be accessed by a foreign government.
(3) Update of information.--
(A) In general.--The Assistant Secretary shall require a
developer to notify a covered company whose application store
distributes the developer's application of any change in--
(i) the country of origin of the developer;
(ii) the beneficial owner of the developer; or
(iii) the country of origin of the beneficial owner of the
developer.
(B) Developer certification.--
(i) In general.--The Assistant Secretary shall require a
developer to certify to each covered company that owns,
controls, or operates an application store through which the
developer's application is distributed, not less frequently
than annually, that the information displayed on the
application store page with respect to the application,
including primary country of origin and beneficial ownership,
is up-to-date.
(ii) Violations.--If a developer violates clause (i)--
(I) the covered company shall issue the developer a series
of not fewer than 3 warnings over a period of not more than
90 days; and
(II) if the developer does not correct the violation by the
date that is 90 days after the date on which the first
warning is issued under subclause (I), the covered company
shall remove the application of the developer from the
application store.
(4) Reporting mechanism.--The Assistant Secretary shall
require a covered company to establish a mechanism that--
(A) allows a user of the covered company's application
store, an employee of a developer whose application is
distributed through the covered company's application store,
or an associated third party to report a potential violation
of this subsection by a developer, including incorrect
information displayed on the application store page; and
(B) allows a report under subparagraph (A) to be made
anonymously.
(5) Written policy for appeals of removals.--The Assistant
Secretary shall require a covered company to establish, for
any application store owned, controlled, or operated by the
covered company, a clear written policy for how a developer
can appeal the removal of an application from the application
store and have the application be reinstated.
SEC. 1004. LIST OF FOREIGN COUNTRIES WITH NATIONAL LAWS
RESULTING IN GOVERNMENT CONTROL OVER
APPLICATIONS.
(a) In General.--Not later than 180 days after the date of
enactment of this Act, and annually thereafter, the Secretary
of the Treasury and the Secretary of Commerce shall jointly
develop and submit to Congress a list of each foreign country
that has in effect a national law that may subject a
developer or application to control by the government of the
country over content moderation, algorithm design, or user
data transfers.
(b) Publication.--With respect to the list developed under
subsection (a)--
(1) the Secretary of the Treasury shall make the list
publicly available on the website of the Department of the
Treasury; and
(2) the Secretary of Commerce shall make the list publicly
available on the website of the Department of Commerce.
SEC. 1005. LIMITATION OF ENFORCEMENT AND REGULATION.
The Assistant Secretary of Commerce for Communications and
Information may not exercise any enforcement authority or
regulatory authority over a covered company or developer that
is not provided under this division, including through
rulemaking.
SEC. 1006. ENFORCEMENT.
The Attorney General may bring a civil action in an
appropriate district court of the United States against any
covered company that violates this division.
______