Senators craft bill to tame social media with privacy requirements

The Senate is trying to tame the Wild West of social media privacy with new legislation that would allow users to opt out of tracking, simplify legalese, and require platforms to notify users of a data breach within 72 hours. On Tuesday, April 24, Senators John Kennedy (R-Louisiana) and Amy Klobuchar (D-Minnesota) introduced the Social Media Privacy and Consumers Rights Act of 2018.

“Every day companies profit off of the data they’re collecting from Americans, yet leave consumers completely in the dark about how their personal information, online behavior, and private messages are being used,” Klobuchar said in a statement. “Consumers should have the right to control their personal data and that means allowing them to opt out of having their data collected and tracked and alerting them within 72 hours when a privacy violation occurs and their personal information may be compromised. The digital space can’t keep operating like the Wild West at the expense of our privacy.”

If passed, the legislation would work to help protect online data and privacy. The bi-partisan bill aims to make privacy and data collection more transparent while giving users options in the event of a privacy breach.

The Social Media Privacy and Consumers Rights Act includes eight main provisions for social media users in the U.S. First, the bill aims to ensure that the terms of service are written in clear language. Second, the bill would require networks to show users what information has been collected about them, while also requiring greater access to control that data. Under the act, social media users would be able to opt out of data tracking. 

The act would also offer “remedies” for when a breach occurs, according to a press release. When networks discover privacy violations, the company would be required to notify users after 72 hours, a requirement likely prompted by the fact that Facebook knew about the Cambridge Analytica breech in 2015 but decided not to tell users when the company claimed to have deleted the data. The act would also make privacy programs a requirement for online platforms.

The act is the second potential legislation to come from Facebook CEO Mark Zuckerberg’s meeting with the Senate earlier in April. On the same day of Zuckerberg’s testimony, the CONSENT Act (Customer Online Notification for Stopping Edge-provider Network Transgressions), a democratic bill proposed requiring opt-in permission rather than the opt-out option that many users often don’t realize is available.

Major social media networks are already implementing changes to comply with a data protection law in the European Union that goes into effect next month. While companies aren’t obligated to uphold that law outside Europe, both Facebook and Twitter have said that the updated privacy policy and any new tools resulting from that law will be shared worldwide. (Other aspects of the law, like a mandated data privacy officer and the fines the network faces for violations, will only be in European Union countries). Many major networks also already have other mandates suggested by the law in place — for example, Instagram just added a data download tool similar to Facebook’s that allows users to see what data the platform has.

There is no word yet on when the new act will be considered by lawmakers.