Purpose

• Establish a consumer-protection framework to enable digital data choice for social media users. The act aims to allow data portability and cross-platform data sharing through open, rules-based interoperability, and to create enforcement mechanisms and penalties for noncompliance.

Key Definitions (to understand the bill)

• Open protocol: A publicly available set of rules that allows interoperability and data exchange between social media platforms through a shared data layer, without licensing or patent barriers.
• Personal data: Information that is linked or reasonably linkable to an identified or identifiable person, including the person’s social graph.
• Social graph: Data representing a person’s connections and interactions on a platform, including what the person generates, their connections, responses to content (comments, reactions, mentions, shares, etc.), public profile, metadata, and relational references. It excludes private content or messages the other users have marked private.
• Social media company: The entity that owns or runs a social media platform.
• Social media platform and user: Terms defined elsewhere in the law.

Main Provisions

• Data rights for users

  • Users can delete personal data held by a social media company.
  • Users can obtain a copy of their personal data processed by the company in a portable, readily usable format to allow transfer to another user or platform.
  • Data provided must avoid revealing trade secrets.
  • Rights requests can be submitted at any time; the company must fulfill within five business days.

• Data interoperability requirements

  • Social media companies must implement a transparent third-party-accessible interoperability interface(s).
  • The interface allows users to share a common set of their current social graph or selected parts of it between designated platforms, with user permission.
  • The interface also enables third parties to access social graph data the user creates and provides notifications when new data is available.
  • When handling interoperability, social media companies must reasonably secure personal data and use an open protocol to ensure real-time data sharing with other platforms under terms that do not discriminate between platforms.
  • Establish reasonable, proportionate thresholds for how often and what kind of data can be requested; may charge fees for requests beyond those thresholds.
  • Companies must provide complete, up-to-date documentation about how to access the interoperability interface.
  • Prohibits collecting or sharing personal data through the interface beyond what is necessary to protect privacy, security, or maintain interoperability.
  • Prohibits sharing or receiving personal data through the interface without user consent.
  • Must offer a clear, persistent method for users to give consent for data sharing with other platforms or third parties, and implement user instructions within five business days.
  • Not required to provide access to internal inferences, proprietary algorithms, ranking systems, or data stored in proprietary formats that aren’t in an open standard.

• Rights regarding internal data and formats

  • The bill clarifies that it does not require access to internal analyses, trade secrets, or proprietary systems, and does not mandate transferring data in non-open formats.

Rulemaking and Legal Framework

• Rulemaking: The attorney general may adopt rules identifying open protocols that meet the requirements of the act.
• Rebuttable presumption: If a social media company uses an open protocol identified by the attorney general, there is a rebuttable presumption that access terms are reasonable and non-discriminatory toward platforms.

Enforcement and Penalties

• Civil penalties: A social media company that violates the act may face an injunction and a civil penalty of up to $2,500 for each affected user.
• Proceedings: Penalties are pursued through civil action brought by the attorney general under the applicable enforcement statute.
• Litigation costs: If the statePrevails, the court may award reasonable litigation expenses to the state.
• Funds and costs: Penalties and expenses recovered go to a special revenue fund and are used to support attorney general enforcement efforts.
• Private rights of action: The act does not create a private right of action for individuals, nor does it override other existing remedies under state law.

Significant Changes to Existing Law

• Introduces a formal data-ports/portability framework tied to social graphs and personal data, with user rights to delete and copy data.
• Requires social media companies to implement interoperable data-sharing interfaces built on open protocols, enabling cross-platform data exchange with user consent.
• Establishes a new administrative-rule process led by the attorney general to identify compliant open protocols and grant a legal presumption of reasonableness for those protocols.
• Creates civil penalties and injunctive remedies for noncompliance, funded through a special revenue mechanism to support enforcement.
• Limits the act from creating private rights of action, focusing enforcement through the attorney general and civil actions.

Relevant Terms - open protocol - interoperability interface - social graph - personal data - data rights - portable format - third-party access - consent - non-discrimination - reasonable term/thresholds - open data standards - trade secrets - internal inferences - ranking systems - civil penalty - injunction - attorney general - special revenue fund - rulemaking - rebuttable presumption - data security - privacy - cross-platform data exchange