Cooper Davis and Devin Norring Act
- Sponsor
- Rep. Miller-Meeks, Mariannette [R-IA-1]
- Committees
- Judiciary Committee (primary)
- Last action
- Jul 17, 2025
Bottom line
This bill mandates tech companies to proactively report specific drug-related crimes occurring on their platforms to federal authorities, aiming to combat illicit drug trafficking while attempting to balance public safety with privacy concerns.
What it actually does
This bill amends the Controlled Substances Act to mandate that electronic communication service providers and remote computing services report to the Attorney General any actual knowledge of crimes involving fentanyl, methamphetamine, counterfeit substances, or unauthorized prescription drugs. It outlines specific information to be reported, establishes penalties for non-compliance, and includes privacy safeguards such as not requiring monitoring or decryption. The bill also exempts broadband internet access and text messaging services from these requirements.
Proponents argue
Supporters argue this bill is crucial for combating the opioid crisis, particularly the proliferation of fentanyl and counterfeit pills sold online, by leveraging tech companies' unique position to identify and report illegal activity, thereby saving lives. They emphasize that it targets serious crimes, includes privacy safeguards by not mandating monitoring or decryption, and provides law enforcement with critical intelligence to disrupt drug networks.
Opponents contend
Opponents may argue that this bill imposes an undue burden on tech companies, potentially leading to over-reporting or chilling effects on user privacy and free speech. Concerns might also be raised about the ambiguity of 'actual knowledge' and the potential for broad data collection by the government, despite stated privacy protections. Some may also contend that the exemptions for certain services create loopholes.
The bill is concise enough that an informed reader can understand its core provisions within a reasonable timeframe, making it accessible for public scrutiny.
Section 2(a)(1), adding new Section 521(b) to the Controlled Substances Act.
Mandatory Reporting of Controlled Substance Violations
This provision mandates electronic communication service providers and remote computing services (referred to as 'providers') to report to the Attorney General, as soon as reasonably possible and no later than 60 days, any actual knowledge of facts or circumstances indicating a crime involving fentanyl, methamphetamine, counterfeit substances (including counterfeit prescription drugs), or unauthorized prescription pain medication/stimulant trafficking. Providers may also report based on a 'reasonable belief' that such facts or circumstances exist.
Supporters argue
Supporters argue this is a critical tool to disrupt online drug sales, particularly of deadly substances like fentanyl, by compelling platforms where these transactions often occur to cooperate with law enforcement. They believe it will save lives by preventing drug overdoses and providing actionable intelligence.
Critics contend
Critics may argue that defining 'actual knowledge' could be problematic and lead to inconsistent application or over-reporting. They might also contend that this places an unreasonable burden on private companies to act as extensions of law enforcement, potentially requiring significant investment in monitoring and reporting infrastructure.
Tradeoffs
Balances the public safety imperative to combat drug trafficking against concerns about corporate responsibility, compliance costs, and the potential for overreach into private communications.
Section 2(a)(1), adding new Section 521(c) to the Controlled Substances Act.
Required and Optional Information in Reports
This section specifies what information providers must include in their reports to the Attorney General. Required information, if within the provider's custody or control, includes account details like name, address, email, user ID, IP address, URL, screen names, and other identifying information, but explicitly excludes the *contents* of wire or electronic communications, unless the provider chooses to include them. Providers *may* also, at their sole discretion, include historical reference data, geographic location information (including VPN use), data relating to the facts or circumstances (e.g., symbols, photos, video, direct messages), and the complete communication containing the crime information.
Section 2(a)(1), adding new Section 521(f) to the Controlled Substances Act.
Penalties for Non-Compliance
This provision establishes criminal and civil penalties for providers. Knowingly failing to submit a required report carries a fine of up to $190,000 for an initial violation and up to $380,000 for subsequent violations. Knowingly submitting a report with materially false or fraudulent information, or omitting reasonably available required information, incurs a civil penalty between $50,000 and $100,000.
Section 2(a)(1), adding new Section 521(g) to the Controlled Substances Act.
Privacy Safeguards and Limitations on Monitoring
This section clarifies that the Act does not require providers to monitor users or the content of their communications, nor does it require them to affirmatively search, screen, or scan for violations. It also states that 'actual knowledge' cannot be proven solely by a provider's decision not to engage in additional verification if facts aren't readily apparent, provided they don't deliberately blind themselves. Crucially, it does not prohibit end-to-end encryption or require a provider to decrypt encrypted communications.
Section 2(a)(1), adding new Section 521(i) to the Controlled Substances Act.
Data Preservation Requirements
A submitted report is treated as a request for the provider to preserve the contents provided in the report, and any reasonably accessible contextual data, for 90 days. The Attorney General can only request extended preservation under 18 U.S.C. 2703(f) if there's an active or pending investigation involving the user account. Providers may not notify users of a preservation request until 45 business days after notifying the Attorney General of their intent to do so. Providers must maintain preserved materials securely and limit access. This section does not affect existing authorities under 18 U.S.C. 2703.
Section 2(a)(1), adding new Section 521(k) to the Controlled Substances Act.
Prohibition on Law Enforcement Initiated Reports
This provision explicitly prohibits federal, Tribal, State, or local law enforcement officers from submitting reports to providers, or arranging for others to do so on their behalf, under this section. Any evidence derived from a provider's report that resulted from such a prohibited action is inadmissible in court.
Section 2(a)(1), adding new Section 521(l) to the Controlled Substances Act.
Exemptions for Certain Service Providers
This provision exempts providers of broadband internet access service (as defined in 47 CFR 8.1(b)) and text messaging service (as defined in 47 U.S.C. 227(e)(8)) from the reporting requirements, but only insofar as they are acting as providers of *those specific services*.
Section 2(b) of the bill, amending Section 2702 of title 18, United States Code.
Authorization for Disclosure to Attorney General
This section amends the Stored Communications Act (SCA) to explicitly permit electronic communication service providers and remote computing services to disclose non-content records (like subscriber information) and content of communications to the Attorney General in connection with a report submitted under the new Section 521 of the Controlled Substances Act. It also clarifies an existing provision regarding inadvertent disclosures to law enforcement.
Exempts providers of broadband internet access service and text messaging service from the reporting requirements, but only when acting *as* providers of those specific services.
Section 2(a)(1), adding new Section 521(l) to the Controlled Substances Act.
Why it matters:This is likely standard legislative practice to define the scope and applicability of a new mandate, often placed at the end of a section. However, its placement and reliance on external definitions could make its significant impact on the scope of the bill less immediately apparent.
Case for: Supporters argue it prevents over-burdening basic infrastructure providers (ISPs, SMS carriers) who primarily act as conduits and may not have the same visibility into content as application-layer services. It focuses the reporting duty on platforms where content moderation and user interaction are more direct.
Case against: Critics might contend that this exemption creates a significant loophole, as illicit drug transactions frequently occur via text messages and general internet access. Excluding these broad communication channels could limit the bill's overall effectiveness in combating online drug sales.
Estimated impact: Significantly narrows the universe of entities subject to the reporting requirement, potentially excluding major communication vectors for illicit activity.
Requires the Attorney General to take reasonable measures to limit the storage of reports and their contents to what is necessary for investigation, and to store them only as long as reasonably necessary, after which they must be deleted unless they have future evidentiary value.
Section 2(a)(1), adding new Section 521(e)(3) to the Controlled Substances Act.
Why it matters:This is standard practice for including safeguards for data handling within government agencies. It's important but not the primary focus of the bill's headline purpose.
Case for: Proponents argue this is a vital protection against government overreach and indefinite data retention, ensuring that collected information is used only for its intended purpose and then discarded, thereby safeguarding privacy.
Case against: Critics might argue that 'reasonable measures' and 'reasonably necessary' are vague terms that could allow for broad interpretation and potentially longer retention periods than strictly necessary, especially with the 'future evidentiary value' clause.
Estimated impact: Provides a legal framework for data handling by the Attorney General, influencing privacy outcomes for individuals whose data is reported.