On May 20, a bipartisan group of senators reintroduced the Social Media Privacy Protection and Consumer Rights Act (Act), which would force big tech companies like Facebook and Google to give consumers greater control over their data and allow them to opt out of data tracking and collection.

"For too long companies have profited off of Americans' online data while consumers have been left in the dark," Senator Amy Klobuchar (D-MN) said. "This legislation will protect and empower consumers by allowing them to make choices about how companies use their data and inform them of how they can protect personal information."

The Social Media Privacy Protection and Consumer Rights Act would, if enacted, require an "online platform" — which includes all public-facing websites and web applications, as well as all social and ad networks — to:

• Establish and maintain a privacy program;
• Audit their privacy programs at least once every two years;
• Provide consumers with easily accessible, plain-language terms of service that include certain specified privacy disclosures;
• Provide consumers (both before and after any personal data is collected) with the right to opt out of the collection and use of their data;
• Provide consumers with the right to access their personal data in an electronic and easily accessible format; and
• Notify consumers of any privacy violation or security breach within 72 hours.

The Act would be enforced by both the Federal Trade Commission (FTC) and state attorneys general, who would be able to obtain restitution, penalties, and other remedies for any violation. It would not, however, create a private right of action or preempt state privacy laws governing online platforms.

The bipartisan group of senators sponsoring the legislation includes Senators Amy Klobuchar (D-MN), John Kennedy (R-LA), Joe Manchin (D-WV), and Richard Burr (R-NC).

Our Take. As we have noted elsewhere, with Democrats in control of both the White House and Congress, and after a series of massive cybersecurity attacks that have raised public support, Congress may finally pass comprehensive privacy legislation.

While the bipartisan Social Media Privacy Protection and Consumer Rights Act is not as comprehensive as other privacy bills that have been introduced, it would govern online platforms — and that, of course, is an area of particular consumer concern. Moreover, the broad transparency obligations and consumer rights created by the Act are similar to those that we expect Congress to eventually embrace. With that in mind, online platforms should consider adopting a proactive, in-front-of-the-curve strategy by, for instance, measuring their privacy program roadmaps against anticipated privacy law developments.