GOE19968

S.L.C.

116TH CONGRESS
1ST SESSION

S. ll

To promote competition and reduce consumer switching costs in the provision
of online communications services.

IN THE SENATE OF THE UNITED STATES
llllllllll
Mr. WARNER (for himself, Mr. HAWLEY, and Mr. BLUMENTHAL) introduced
the following bill; which was read twice and referred to the Committee
on llllllllll

A BILL
To promote competition and reduce consumer switching costs
in the provision of online communications services.
1

Be it enacted by the Senate and House of Representa-

2 tives of the United States of America in Congress assembled,
3
4

SECTION 1. SHORT TITLE.

This Act may be cited as the ‘‘Augmenting Compat-

5 ibility and Competition by Enabling Service Switching Act
6 of 2019’’ or the ‘‘ACCESS Act of 2019’’.
7

SEC. 2. DEFINITIONS.

8

In this Act:

9
10

(1) COMMISSION.—The term ‘‘Commission’’
means the Federal Trade Commission.

 GOE19968

S.L.C.

2
1

(2) COMMUNICATIONS

PROVIDER.—The

term

2

‘‘communications provider’’ means a consumer-fac-

3

ing communications and information services pro-

4

vider.

5

(3) COMPETING

COMMUNICATIONS PROVIDER.—

6

The term ‘‘competing communications provider’’,

7

with respect to a large communications platform

8

provider, means another communications provider

9

offering, or planning to offer, similar products or

10
11

services to consumers.
(4) COMPETING

COMMUNICATIONS SERVICE.—

12

The term ‘‘competing communications service’’, with

13

respect to a large communications platform, means

14

a similar product or service provided by a competing

15

communications provider.

16

(5) CUSTODIAL

THIRD-PARTY

AGENT.—The

17

term ‘‘custodial third-party agent’’ means an entity

18

that is duly authorized by a user to interact with a

19

large communications platform provider on that

20

user’s behalf to manage the user’s online inter-

21

actions, content, and account settings.

22

(6) INTEROPERABILITY

INTERFACE.—The

term

23

‘‘interoperability interface’’ means an electronic

24

interface maintained by a large communications

25

platform for purposes of achieving interoperability.

 GOE19968

S.L.C.

3
1

(7) LARGE

COMMUNICATIONS PLATFORM.—The

2

term ‘‘large communications platform’’ means a

3

product or service provided by a communications

4

provider that—

5

(A) generates income, directly or indirectly,

6

from the collection, processing, sale, or sharing

7

of user data; and

8
9
10

(B) has more than 100,000,000 monthly
active users in the United States.
(8) LARGE

COMMUNICATIONS PLATFORM PRO-

11

VIDER.—The

12

provider’’ means a communications provider that

13

provides, manages, or controls a large communica-

14

tions platform.

15

(9) USER

16
17

DATA.—

(A) IN

GENERAL.—The

term ‘‘user data’’

means information that is—

18
19

term ‘‘large communications platform

(i) collected directly by a communications provider; and

20

(ii) linked, or reasonably linkable, to a

21

specific person.

22

(B) EXCLUSION.—The term ‘‘user data’’

23

does not include information that is rendered

24

unusable,

25

anonymized.

unreadable,

de-identified,

or

 GOE19968

S.L.C.

4
1
2

SEC. 3. PORTABILITY.

(a) GENERAL DUTY

OF

LARGE COMMUNICATIONS

3 PLATFORM PROVIDERS.—A large communications plat4 form provider shall, for each large communications plat5 form it operates, maintain a set of transparent, third6 party-accessible interfaces (including application program7 ming interfaces) to initiate the secure transfer of user data
8 to a user, or to a competing communications provider act9 ing at the direction of a user, in a structured, commonly
10 used, and machine-readable format.
11
12

(b) GENERAL DUTY
TIONS

OF

COMPETING COMMUNICA-

PROVIDERS.—A competing communications pro-

13 vider that receives ported user data from a large commu14 nications platform provider shall reasonably secure any
15 user data it acquires.
16

(c) EXEMPTION

FOR

CERTAIN SERVICES.—The obli-

17 gations under this section shall not apply to a product or
18 service by which a large communications platform provider
19 does not generate any income or other compensation, di20 rectly or indirectly, from collecting, using, or sharing user
21 data.
22
23

SEC. 4. INTEROPERABILITY.

(a) GENERAL DUTY

OF

LARGE COMMUNICATIONS

24 PLATFORM PROVIDERS.—A large communications plat25 form provider shall, for each large communications plat26 form it operates, maintain a set of transparent, third-

 GOE19968

S.L.C.

5
1 party-accessible interfaces (including application program2 ming interfaces) to facilitate and maintain technically
3 compatible, interoperable communications with a user of
4 a competing communications provider.
5
6

(b) GENERAL DUTY
TIONS

OF

COMPETING COMMUNICA-

PROVIDERS.—A competing communications pro-

7 vider that accesses an interoperability interface of a large
8 communications platform provider shall reasonably secure
9 any user data it acquires, processes, or transmits.
10

(c) INTEROPERABILITY OBLIGATIONS

FOR

LARGE

11 COMMUNICATIONS PLATFORM PROVIDERS.—
12

(1) IN

GENERAL.—In

order to achieve inter-

13

operability under subsection (a), a large communica-

14

tions platform provider shall fulfill the duties under

15

paragraphs (2) through (6) of this subsection.

16
17

(2) NON-DISCRIMINATION.—
(A) IN

GENERAL.—A

large communica-

18

tions platform provider shall facilitate and

19

maintain interoperability with competing com-

20

munications services for each of its large com-

21

munications platforms through an interoper-

22

ability interface, based on fair, reasonable, and

23

nondiscriminatory terms.

24
25

(B) REASONABLE

THRESHOLDS, ACCESS

STANDARDS, AND FEES.—

 GOE19968

S.L.C.

6
1

(i) IN

GENERAL.—A

large commu-

2

nications platform provider may establish

3

reasonable thresholds related to the fre-

4

quency, nature, and volume of requests by

5

a competing communications provider to

6

access resources maintained by the large

7

communications platform provider, beyond

8

which the large communications platform

9

provider may assess a reasonable fee for

10
11

such access.
(ii) USAGE

EXPECTATIONS.—A

large

12

communications platform provider may es-

13

tablish fair, reasonable, and nondiscrim-

14

inatory usage expectations to govern access

15

by competing communications providers,

16

including fees or penalties for providers

17

that exceed those usage expectations.

18

(iii) LIMITATION

ON FEES AND USAGE

19

EXPECTATIONS.—Any

20

usage expectations assessed under clauses

21

(i) and (ii) shall be reasonably proportional

22

to the cost, complexity, and risk to the

23

large communications platform provider of

24

providing such access.

fees, penalties, or

 GOE19968

S.L.C.

7
1

(iv) NOTICE.—A large communica-

2

tions platform provider shall provide public

3

notice of any fees, penalties, or usage ex-

4

pectations that may be established under

5

clauses (i) and (ii), including reasonable

6

advance notice of any changes.

7

(v) SECURITY

AND PRIVACY STAND-

8

ARDS.—A

9

provider shall, consistent with industry

10

best practices, set privacy and security

11

standards for access by competing commu-

12

nications services to the extent reasonably

13

necessary to address a threat to the large

14

communications platform or user data, and

15

shall report any suspected violations of

16

those standards to the Commission.

17

(C) PROHIBITED

large communications platform

CHANGES

TO

INTER-

18

FACES.—A

19

face or terms of use made with the purpose, or

20

substantial effect, of unreasonably denying ac-

21

cess or undermining interoperability for com-

22

peting communications services shall be consid-

23

ered a violation of the duty under subparagraph

24

(A) to facilitate and maintain interoperability

change to an interoperability inter-

 GOE19968

S.L.C.

8
1

based on fair, reasonable, and nondiscrim-

2

inatory terms.

3

(3) FUNCTIONAL

EQUIVALENCE.—A

large com-

4

munications platform provider that maintains inter-

5

operability between its own large communications

6

platform and other products, services, or affiliated

7

offerings of such provider shall offer a functionally

8

equivalent version of that interface to competing

9

communications services.

10

(4) INTERFACE

11

(A) IN

INFORMATION.—

GENERAL.—Not

later than 120

12

days after the date of enactment of this Act, a

13

large communications platform provider shall

14

disclose to competing communications providers

15

complete and accurate documentation describ-

16

ing access to the interoperability interface re-

17

quired under this section.

18
19

(B) CONTENTS.—The documentation required under subparagraph (A)—

20

(i) is limited to interface documenta-

21

tion necessary to achieve development and

22

operation of interoperable products and

23

services; and

 GOE19968

S.L.C.

9
1

(ii) does not require the disclosure of

2

the source code of a large communications

3

platform.

4

(5) NOTICE

OF CHANGES.—A

large communica-

5

tions platform provider shall provide reasonable ad-

6

vance notice to a competing communications pro-

7

vider, which may be provided through public notice,

8

of any change to an interoperability interface main-

9

tained by the large communications platform pro-

10

vider that will affect the interoperability of a com-

11

peting communications service.

12

(6) NON-COMMERCIALIZATION

BY

A

LARGE

13

COMMUNICATIONS PLATFORM PROVIDER.—A

14

communications platform provider may not collect,

15

use, or share user data obtained from a competing

16

communications service through the interoperability

17

interface except for the purposes of safeguarding the

18

privacy and security of such information or main-

19

taining interoperability of services.

20

(d) NON-COMMERCIALIZATION

BY

A

large

COMPETING

21 COMMUNICATIONS PROVIDER.—A competing communica22 tions provider that accesses an interoperability interface
23 may not collect, use, or share user data obtained from a
24 large communications platform provider through the inter25 operability interface except for the purposes of safe-

 GOE19968

S.L.C.

10
1 guarding the privacy and security of such information or
2 maintaining interoperability of services.
3

(e) EXEMPTION

FOR

CERTAIN SERVICES.—The obli-

4 gations under this section shall not apply to a product or
5 service by which a large communications platform provider
6 does not generate any income or other compensation, di7 rectly or indirectly, from collecting, using, or sharing user
8 data.
9
10

SEC. 5. DELEGATABILITY.

(a) GENERAL DUTY

OF

LARGE COMMUNICATIONS

11 PLATFORM PROVIDERS.—A large communications plat12 form provider shall maintain a set of transparent third13 party-accessible interfaces by which a user may delegate
14 a custodial third-party agent to manage the user’s online
15 interactions, content, and account settings on a large com16 munications platform on the same terms as a user.
17

(b) AUTHENTICATION.—Not later than 180 days

18 after the date of enactment of this Act, the Commission
19 shall establish rules and procedures to facilitate a custo20 dial third-party agent’s ability to obtain access pursuant
21 to subsection (a) in a way that ensures that a request for
22 access on behalf of a user is a verifiable request.
23

(c) REGISTRATION WITH

THE

COMMISSION.—A cus-

24 todial third-party agent shall register with the Commission

 GOE19968

S.L.C.

11
1 as a condition of, and prior to, accessing an interface de2 scribed in subsection (a).
3

(d) DEREGISTRATION

BY THE

COMMISSION.—The

4 Commission shall establish rules and procedures to
5 deregister a custodial third-party agent that the Commis6 sion determines has violated the duties established in this
7 section.
8

(e) REVOCATION

OF

ACCESS RIGHTS.—A large com-

9 munications platform provider may revoke or deny access
10 for any custodial third-party agent that—
11

(1) fails to register with the Commission; or

12

(2) repeatedly facilitates fraudulent or mali-

13

cious activity.

14

(f)

DUTIES

OF

A

CUSTODIAL

THIRD-PARTY

15 AGENT.—A custodial third-party agent—
16

(1) shall reasonably safeguard the privacy and

17

security of user data provided to it by a user, or

18

accessed on a user’s behalf;

19

(2) shall not access or manage a user’s online

20

interactions, content, or account settings in any way

21

that—

22
23
24
25

(A) will benefit the custodial third-party
agent to the detriment of the user;
(B) will result in any reasonably foreseeable harm to the user; or

 GOE19968

S.L.C.

12
1

(C) is inconsistent with the directions or

2

reasonable expectations of the user; and

3

(3) shall not collect, use, or share any user data

4

provided to it by a user, or accessed on a user’s be-

5

half, for the commercial benefit of the custodial

6

third-party agent.

7

(g) FEES.—A custodial third-party agent may charge

8 users a fee for the provision of the products or services
9 described in subsection (a).
10

(h) EXTENT

OF

ACCESS RIGHTS.—Nothing in this

11 section shall be construed to confer greater rights of ac12 cess for a custodial third-party agent to a large commu13 nications platform than are accessible to a user.
14
15

SEC. 6. IMPLEMENTATION AND ENFORCEMENT.

(a) REGULATIONS.—Not later than 1 year after the

16 date of enactment of this Act, the Commission shall pro17 mulgate regulations to implement section 4(c)(2)(B)(v)
18 and subsections (b), (c), and (d) of section 5.
19

(b) AUTHENTICATION.—Not later than 180 days

20 after the date of enactment of this Act, the Commission,
21 in consultation with relevant industry stakeholders, shall
22 establish rules and procedures to facilitate the verification
23 of the validity of requests from users and competing com24 munications providers to obtain user data under sections
25 3(a) and 4(a).

 GOE19968

S.L.C.

13
1

(c) TECHNICAL STANDARDS.—Not later than 180

2 days after the date of enactment of this Act, the Director
3 of the National Institute of Standards and Technology
4 shall develop and publish model technical standards by
5 which to make interoperable popular classes of commu6 nications or information services, including—
7

(1) online messaging;

8

(2) multimedia sharing; and

9

(3) social networking.

10

(d) COMPLIANCE ASSESSMENT.—The Commission

11 shall regularly assess compliance by large communications
12 platform providers with the provisions of this Act.
13

(e) COMPLAINTS.—The Commission shall establish

14 procedures under which a user, a large communications
15 platform provider, a competing communications provider,
16 and a custodial third-party agent may file a complaint al17 leging that a large communications platform provider, a
18 competing communication provider, or a custodial third19 party agent has violated this Act.
20

(f) ENFORCEMENT.—

21

(1) UNFAIR

OR DECEPTIVE ACTS OR PRAC-

22

TICES.—A

23

acted pursuant to this Act, shall be treated as a vio-

24

lation of a rule defining an unfair or deceptive act

25

or practice prescribed under section 18(a)(1)(B) of

violation of this Act, or regulations en-

 GOE19968

S.L.C.

14
1

the Federal Trade Commission Act (15 U.S.C.

2

57a(a)(1)(B)).

3

(2) POWERS

OF COMMISSION.—

4

(A) IN

GENERAL.—Except

as provided in

5

subparagraph (C), the Commission shall enforce

6

this Act in the same manner, by the same

7

means, and with the same jurisdiction, powers,

8

and duties as though all applicable terms and

9

provisions of the Federal Trade Commission

10

Act (15 U.S.C. 41 et seq.) were incorporated

11

into and made a part of this Act.

12

(B) PRIVILEGES

AND IMMUNITIES.—Ex-

13

cept as provided in subparagraph (C), any per-

14

son who violates section 3 shall be subject to

15

the penalties and entitled to the privileges and

16

immunities provided in the Federal Trade Com-

17

mission Act (15 U.S.C. 41 et seq.).

18

(C) NONPROFIT

ORGANIZATIONS AND COM-

19

MON CARRIERS.—Notwithstanding

20

5(a)(2) of the Federal Trade Commission Act

21

(15 U.S.C. 44, 45(a)(2)) or any jurisdictional

22

limitation of the Commission, the Commission

23

shall also enforce this Act, in the same manner

24

provided in subparagraphs (A) and (B) of this

25

paragraph, with respect to common carriers

section 4 or

 GOE19968

S.L.C.

15
1

subject to the Communications Act of 1934 (47

2

U.S.C. 151 et seq.).

3

(D) FINES.—In assessing any fine for a

4

violation of this Act, the Commission shall con-

5

sider each individual user affected by a violation

6

of this Act as an individual violation.

7

(g) RELIANCE

ON

OPEN STANDARDS.—Any large

8 communications platform provider that establishes and
9 maintains interoperability through an open standard es10 tablished under subsection (c) shall be entitled to a rebut11 table presumption of providing access on fair, reasonable,
12 and nondiscriminatory terms.
13

(h) PREEMPTION.—The provisions of this Act shall

14 preempt any State law only to the extent that such State
15 law is inconsistent with the provisions of this Act.
16

(i) EFFECTIVE DATE.—This Act shall take effect on

17 the date on which the Commission promulgates regula18 tions under subsection (a).
19
20

SEC. 7. RELATION TO OTHER LAWS.

Nothing in this Act shall be construed to modify,

21 limit, or supersede the operation of any privacy or security
22 provision in—
23
24

(1) section 552a of title 5, United States Code
(commonly known as the ‘‘Privacy Act of 1974’’);

 GOE19968

S.L.C.

16
1
2
3
4
5
6
7
8
9
10
11
12

(2) the Right to Financial Privacy Act of 1978
(12 U.S.C. 3401 et seq.);
(3) the Fair Credit Reporting Act (15 U.S.C.
1681 et seq.);
(4) the Fair Debt Collection Practices Act (15
U.S.C. 1692 et seq.);
(5) the Children’s Online Privacy Protection
Act of 1998 (15 U.S.C. 6501 et seq.);
(6) title V of the Gramm-Leach-Bliley Act (15
U.S.C. 6801 et seq.);
(7) chapters 119, 123, and 206 of title 18,
United States Code;

13

(8) section 444 of the General Education Provi-

14

sions Act (20 U.S.C. 1232g) (commonly referred to

15

as the ‘‘Family Educational Rights and Privacy Act

16

of 1974’’);

17
18
19
20

(9) section 445 of the General Education Provisions Act (20 U.S.C. 1232h);
(10) the Privacy Protection Act of 1980 (42
U.S.C. 2000aa et seq.);

21

(11) the regulations promulgated under section

22

264(c) of the Health Insurance Portability and Ac-

23

countability Act of 1996 (42 U.S.C. 1320d–2 note),

24

as those regulations relate to—

 GOE19968

S.L.C.

17
1

(A) a person described in section 1172(a)

2

of the Social Security Act (42 U.S.C. 1320d–

3

1(a)); or

4

(B) transactions referred to in section

5

1173(a)(1) of the Social Security Act (42

6

U.S.C. 1320d–2(a)(1));

7

(12) the Communications Assistance for Law

8
9
10
11
12

Enforcement Act (47 U.S.C. 1001 et seq.);
(13) sections 222 and 227 of the Communications Act of 1934 (47 U.S.C. 222, 227); or
(14) any other privacy or security provision of
Federal law.