S. 3292 — Platform Accountability and Transparency Act

This section designates the Act as the “Platform Accountability and Transparency Act” and sets forth the table of contents.

This section defines terms used in the Act, including "Commission" (i.e., Federal Trade Commission), "NSF" (i.e., National Science Foundation), "personal information" (i.e., any information linked or reasonably linkable to a specific consumer or device), "platform" (i.e., an entity subject to FTC jurisdiction under 15 U.S.C. 45(a)(2) that operates specified websites or applications for user-generated content and interaction, primarily serves as a medium for such content and ads, and has at least 50,000,000 unique monthly U.S. users for a majority of the most recent 12-month period), "qualified data and information" (i.e., certain platform data necessary, feasible, and proportionate for approved research projects, excluding direct private messages, biometric information, and precise geospatial information), "qualified researcher" (i.e., a researcher affiliated with a U.S. university or 501(c) nonprofit approved for a qualified research project, excluding those affiliated with law enforcement or intelligence agencies), "qualified research project," "State," and "user."

This section directs the National Science Foundation (NSF), in consultation with the Commission, to establish within one year of enactment a research program to review applications and approve qualified research projects, which require online platforms to share qualified data and information with qualified researchers under specified privacy and cybersecurity safeguards. The program requires (1) NSF to solicit and review applications for scientific merit, identify qualified researchers and data, publish guidelines, and exclude requests for certain sensitive data; (2) the Commission to review applications for privacy and cybersecurity risks, establish tailored safeguards (e.g., encryption, de-identification, access logs), consider secure data environments, publish criteria, solicit comments from platforms and researchers, ensure researcher compliance capacity, and conduct prepublication review of analyses to protect personal information and trade secrets; (3) nondiscrimination in application reviews based on protected characteristics; (4) institutional review board (IRB) approval, exemption, or exclusion for approved projects; and (5) platforms' rights to comment on and appeal approvals on specified grounds. This section further requires qualified researchers to demonstrate capacity to comply with safeguards and limits approvals to projects in the public interest that aim to study platform activity.

This section requires online platforms to provide qualified researchers access to qualified data and information for approved research projects under Commission-specified privacy and cybersecurity safeguards; prohibits platforms from restricting or terminating such access for ongoing projects except upon reasonable belief of safeguard violations, with mandatory Commission notification and review; directs the Commission to require platforms to inform users of privacy protections and required data sharing; provides platforms immunity from state or federal causes of action for compliant data releases; authorizes qualified researchers or affiliates to seek district court injunctive relief or Commission enforcement against non-compliant platforms; and preserves platforms' rights to address immediate safety threats or security incidents (e.g., fraud, harassment, or illegal activity).

This section establishes obligations for qualified researchers accessing qualified data and information, requiring use only for authorized research purposes under the terms of the qualified research project and in accordance with Commission-prescribed privacy and cybersecurity safeguards. It prohibits such researchers from (1) reidentifying, disclosing, publishing, or using personal information derived from the data for commercial purposes; or (2) disclosing the data to third parties, with intentional, reckless, or negligent violations of safeguards subject to civil and criminal enforcement under applicable federal, state, and local laws and possible referral by the Commission to the Department of Justice or appropriate state law enforcement agencies.

This section requires the National Science Foundation (NSF) and the Commission to submit to Congress a joint report on the operation of this Act, not later than 24 months after the date of enactment and annually thereafter. For each qualified research project, the report must include (1) the identity of any authorized qualified researcher and the researcher's affiliated institution; (2) the platforms required to provide qualified data and information to qualified researchers; (3) the categories of qualified data and information each platform was required to provide; (4) the terms of the privacy and cybersecurity safeguards prescribed by the Commission; and (5) recommendations for improvements to facilitate enhanced platform transparency.

This section deems a platform's failure to comply with subsections (a) or (b) of section 4, or a qualified researcher's failure to comply with subsections (a) or (b) of section 5, as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)), enforceable by the Federal Trade Commission (FTC) using the same manner, jurisdiction, powers, duties, penalties, privileges, and immunities as under the FTC Act (15 U.S.C. 41 et seq.). The section further (1) authorizes the FTC to promulgate implementing regulations under the Administrative Procedure Act (5 U.S.C. 553); and (2) allows the prevailing party in an appealed enforcement action, in the court's discretion, to recover costs including reasonable investigative costs and attorneys' fees.

This section establishes a safe harbor shielding journalists and researchers from civil lawsuits by online platforms for collecting covered information—defined as publicly available information (excluding obscene visual depictions as used in 18 U.S.C. §1460, biometric or genetic information, or nonconsensual intimate images), including information recommended, targeted, amplified, or de-amplified to users or research accounts, and advertisement information—through covered methods of digital investigation (i.e., automated collection from user interfaces or use of research accounts, including to observe minors' feeds). The safe harbor applies if the collection furthers a journalism or research project on matters of public concern, the information is not retained, disclosed, or transferred except for that purpose, and reasonable privacy measures are taken (e.g., avoiding collection of extraneous personally identifiable information and restricting its publication except for advertisers, public officials or figures, or consenting adults). It further (1) clarifies that compliant collection does not constitute unauthorized access; (2) excludes protection for training large language models; (3) directs the Secretary of Commerce to issue clarifying regulations within 180 days of enactment to address research accounts and avoid misleading users or burdening platform operations (without redefining journalism or public concern); (4) states it creates no new liability; and (5) prohibits government entities from compelling disclosure of collected information.

This section directs the Commission, in accordance with the Administrative Procedure Act (5 U.S.C. 553) and subject to subsection (g), to issue regulations as follows: (1) authorizing requirements for platforms to provide data, metrics, or other information to qualified researchers to facilitate public-interest research, after consultation with the NSF and NIH, with specified factors, forms, frequencies, retention periods, and privacy/cybersecurity safeguards modeled on section 3; and (2) not later than one year after enactment, requiring platforms to maintain a public, searchable repository (via online interface and APIs) of information on highly disseminated content (defined as viewed by at least 10,000 unique users) and content from major public accounts (followed by or regularly reaching at least 25,000 users), including content details, metrics, algorithmic actions, and user account information, updated in real time to the extent practicable; and (3) not later than one year after enactment, requiring platforms to maintain a public, searchable repository (via online interface and APIs) of advertising information, covering the advertisement period plus one year thereafter and excluding recipients' personal information.

This section provides a severability clause, stating that if any provision of the Act or its application to any person or circumstance is held unconstitutional, the remainder of the Act and the application of its remaining provisions to any person or circumstance shall not be affected.