Washington, DC – May 23, 2024. House Innovation, Data, and Commerce Subcommittee Markup. Source
The House subcommittee meeting may have foreshadowed the fate of data privacy and child online safety legislation this Congress. Two key bills advanced unanimously to the House Energy and Commerce Committee floor last Thursday, but lawmakers from both parties, including the committee’s chair and ranking member, expressed concerns.
The House Energy and Commerce Committee’s Innovation, Data and Commerce Subcommittee’s Bill Revision Session discussed an updated discussion draft of the American Privacy Rights Act (APRA), which would establish comprehensive data privacy regulation, and the Child Online Safety Act (KOSA), which would impose a duty of care on the largest social media companies and require strong default privacy and safety settings and features for young users.
APRA is a bicameral, bipartisan project led by the powerful chairs of the House and Senate Commerce Committees, Rep. Cathy McMorris Rodgers (R-WA) and Sen. Maria Cantwell (D-WA). The House version of KOSA is led by Innovation, Data and Commerce Subcommittee Chair Gus Bilirakis (R-FL) and Rep. Cathy Kastor (D-FL), and the Senate version has about 70 co-sponsors from both parties.
Twelve amendments were introduced to the bill during the session, but lawmakers won’t consider it until the full committee meeting. Discussions about transparency and investigative measures were prominent, but broader issues could ultimately stymie the bill’s progress this Congress.
Promoting Transparency and Inquiry in Congress’ Online Privacy and Safety Package
Advocates urged APRA and KOSA to include transparency and scrutiny measures that were reduced or removed from previous versions of the bill.A letter-writing campaign ahead of the proposed amendments produced mixed results, exposing the wider divisions over the bill.
The previous version of KOSA, which was considered by the Senate, included an independent research program to request data from large online platforms for academic and non-profit research. The American Data Privacy Protection Act (ADPPA), introduced in the last Congress, includes an exemption for data collection and processing for public interest research and reporting. Civil society groups and researchers have called on the committee to add similar research programs and protections back into KOSA and APRA.
The Center for American Progress, a progressive think tank, called in a letter to APRA sponsors Rep. McMorris Rodgers and Sen. Cantwell to add ADPPA’s public interest research protections to APRA. Similarly, nonprofit research organization Children and Screens, in collaboration with the nonpartisan political advocacy group Issue One, wrote to the leadership of the House Energy and Commerce Committee calling for “the strongest possible transparency provisions” for independent research and public reporting in APRA and KOSA.
The petition was supported by dozens of nonprofits and researchers, including the American Psychological Association, the Center for Democracy and Technology, New America’s Open Technology Institute, the Coalition for Independent Technology Research, and my colleagues Rene DiResta and Jeff Hancock at the Stanford Internet Observatory.
The effort appears to have been successful in persuading lawmakers to add public interest research protections to APRA’s revised version, but some lawmakers say the new language doesn’t go far enough and there are differences of opinion about KOSA’s research requirements.
APRA discussion draft adds public interest research protections
While no amendments were adopted during the markup session, APRA’s discussion draft was significantly updated ahead of the meeting. One change adds additional protections for researchers to collect and use data for academic research or in the public interest.
Rep. Lori Trahan (D-Mass.) said she had asked for changes to APRA to protect independent research. She also offered an amendment to establish safe harbor protections for researchers to collect public information from online platforms about “matters of public concern.” The language is nearly identical to provisions in the Platform Accountability and Transparency Act, a bill stalled in the Senate.
“I am pleased that the changes I proposed are included in the latest draft, allowing consumers to delete their data held by data brokers and restoring public interest and peer-reviewed research as permitted purposes,” Rep. Trahan said during the markup session. In the past Congress, she introduced the Digital Services Oversight and Safety Act (DSOSA), which includes a comprehensive scheme to allow for independent research. Rep. Trahan, along with Rep. Jay Obernolte (R-Calif.), sent a letter to the Biden Administration in May 2023 urging it to establish an International Research Center on Online Harms.
Rep. Larry Buckson (R-Ind.) expressed concern that APRA could restrict medical research into drugs and treatments. “The draft bill limits the general scientific research exemption to published, peer-reviewed studies, which in my view is somewhat restrictive,” he said.
Speaking after the session, Alix Fraser, director of Issue One’s Responsible Social Media Council, said the privacy law essentially mandates independent investigations by researchers and access to the data.
“Privacy legislation will never be complete without effective transparency provisions to ensure compliance with the law. Technology companies have proven time and time again that they cannot be trusted to grade their own homework. We need fair access to all the information we need to understand the intent and impact of the products these companies develop,” Fraser said in an email.
Update or delete a KOSA research program
The Senate’s previous version of KOSA included a program for independent researchers to propose studies related to children’s online safety and request data from major social media companies, which researchers hoped would help spur broader research using social media companies’ data.
This research program was replaced with a much more limited provision when the Senate Commerce Committee introduced the KOSA bill to the full Senate in July 2023. The updated provision tasked the Federal Trade Commission (FTC) with contracting with the National Academy of Sciences to conduct a series of studies “on the risks of harm to minors from the use of social media and other online platforms.”
Rep. Trahan and leadership of the House Energy and Commerce Committee have expressed dissatisfaction with the changes made in the Senate, but a solution remains to be found.
“I am extremely disappointed that the Senate has removed KOSA’s original provision to encourage independent research and replaced it with a limited set of studies that provide little of the accountability or insight that proponents originally intended with this bill,” said Rep. Trahan.
House Energy and Commerce Chairman Frank Pallone (D-NJ) also opposed the change, but offered an amendment to remove the section about the National Academy of Sciences study without providing an alternative text. He cited a recent National Academy of Sciences committee report on social media and adolescent well-being, and the FTC’s limited funding to enter into contracts.
“According to National Academy of Sciences staff, no new research has been published in this time that would change the findings, and therefore it is my opinion that a new report by the National Academy of Sciences is not necessary at this time,” Pallone said.
“Funding these investigations would force the FTC to cut important consumer protection work and leave it with less money to enforce new requirements. This is not only redundant, it is harmful.”
Tech industry lobbying and conservative concerns about online censorship and overreach were likely the driving forces behind replacing the KOSA research program with a series of studies by the National Academy of Sciences, according to multiple sources familiar with the discussions.
“I have long advocated for the FTC to remain focused on its consumer protection mission. The FTC must be focused on enforcing the provisions of the Data Privacy Act. Now is the time to keep the FTC focused on the mission I am directing it to do today,” Chairman Rogers said in support of the Pallone amendment.
While Republican leaders support removing the section on KOSA research, Rep. Trahan said Rep. Pallone’s amendment should be used to reinstate the broader research program.
“I agree with Senator Pallone and many others that we should improve this section on independent investigations, and I think it’s best to start with the original bipartisan provision that actually allowed for independent accountability for these platforms,” Trahan said.
What’s next?
The bills will now go to the House of Representatives Energy and Commerce Committee for consideration. APRA remains a discussion draft that has not yet been formally introduced or assigned a bill number, while KOSA has already advanced to the Senate.
While the bill has strong support, with APRA sponsored by the House and Senate Commerce Committee chairs and Senate Majority Leader Chuck Schumer signing on as a KOSA co-sponsor, problems remain.
According to Axios, House Republican leaders have refrained from supporting APRA due to concerns about weak preemption of state privacy laws and a civil right of action. Sen. Ted Cruz (R-Texas), chairman of the Senate Commerce Committee, opposes a civil right of action that would allow private plaintiffs to sue for privacy violations, according to Bloomberg’s Oma Seddiq.
California’s Democratic caucus has previously opposed any privacy legislation that would override the state’s regulations.
“Americans should not have to settle for a federal privacy law that limits the state’s ability to advance strong protections in response to rapid technological change and emerging policy threats, especially at a time when Californians’ fundamental rights are at stake,” Ashkan Soltani, executive director of the California Department of Privacy Protection, told the International Association of Privacy Professionals.
KOSA is awaiting a vote on the full Senate floor by its 68 filibuster-proof co-sponsors. Politico reported earlier this month that the Senate would begin a hotline process to poll lawmakers about their support or opposition to a bill before bringing it to the floor for a vote.
Sen. Ron Wyden (D-Ore.) had previously blocked a vote on KOSA by voicing his intention to oppose a motion for unanimous consent to the bill, citing concerns that state attorneys general could use the bill to crack down on LGBTQ+ content.
Similarly, in the House amendment, Senator Pallone opposed KOSA’s duty of care provision. “A duty of care could lead social media companies to over-filter content out of concern for legal risks, denying young people access to helpful, even life-saving, content,” he said.
He argued that children’s online safety “can only be addressed through reform of Section 230.” The committee is considering a complete repeal of Section 230, and the day before the House Energy and Commerce Committee amendment meeting, a hearing will be held on a bill introduced by Rep. Pallone and Chairman Rogers to repeal the measure.
While KOSA curtailed enforcement powers for state attorneys general, some civil society groups continue to oppose the bill. A letter led by the Center for Democracy and Technology argued that the duty of care still “can be misused to target marginalized communities or politically divisive information.” The letter also raised privacy concerns about the parental tools mandated in the bill.
APRA and KOSA could be landmarks for data privacy and online safety, but unresolved debates about the fundamentals of national privacy law and concerns about freedom of expression, respectively, may continue to hinder progress. There seems to be a growing recognition among lawmakers that the battle over researchers’ access to data is a difficult policy issue that must be addressed somehow.
