Cooper Davis and Devin Norring Act
- Sponsor
- Sen. Marshall, Roger [R-KS]
- Committees
- Judiciary Committee (primary)
- Last action
- Jul 17, 2025
Bottom line
This bill mandates tech companies to proactively report specific drug-related crimes to the Attorney General, aiming to combat the online proliferation of illicit substances, while also establishing privacy protections and reporting accountability.
What it actually does
This bill mandates electronic communication service providers and remote computing services to report to the Attorney General when they obtain actual knowledge of specific controlled substance violations, including those involving fentanyl, methamphetamine, counterfeit substances, or unauthorized prescription drugs. It outlines the information to be included in these reports, establishes penalties for non-compliance or false reporting, and requires the Attorney General to publish an annual report on the program's effectiveness. The bill also includes explicit privacy protections, stating that providers are not required to monitor users or decrypt communications.
Proponents argue
Supporters argue this bill is a crucial step to combat the fentanyl crisis and the online sale of illicit drugs, which often target young people. They contend that tech companies have a responsibility to report illegal activities occurring on their platforms, especially those leading to overdose deaths, and that this measure provides law enforcement with necessary tools to track and prosecute drug traffickers.
Opponents contend
Critics might argue that this bill could lead to over-reporting, infringe on user privacy, or place an undue burden on service providers, potentially forcing them to monitor user communications more closely than current law requires. Concerns could also be raised about the potential for misuse of reported data or the chilling effect on free speech and encrypted communications, despite the bill's explicit privacy protections.
The bill is moderately complex due to legal definitions and detailed reporting requirements, but its length makes it accessible for an informed reader to review within a reasonable timeframe.
Section 1
Short Title: Cooper Davis and Devin Norring Act
This section establishes the official short title of the Act as the "Cooper Davis and Devin Norring Act." This naming convention often honors individuals whose experiences or tragedies inspired the legislation, highlighting the human impact the bill aims to address.
Supporters argue
Supporters argue that naming the bill after victims of drug-related crimes personalizes the issue and underscores the urgency and human cost of the fentanyl crisis, galvanizing support for stronger measures.
Critics contend
No specific opposition is typically raised against the naming of a bill, though some might argue it is a symbolic gesture that does not address the underlying policy issues.
Tradeoffs
The tradeoff is between purely descriptive titles and titles that carry emotional or symbolic weight, aiming to build public and political support.
Section 2(a)(1), adding Section 521(a) to the Controlled Substances Act
Definitions of Key Terms for Reporting
This section defines critical terms such as "electronic communication service," "remote computing service," "provider," "electronic mail address," "Internet," and "website." These definitions are crucial for determining which entities are subject to the new reporting requirements and what types of communications and online activities fall under the bill's scope.
Section 2(a)(1), adding Section 521(b) to the Controlled Substances Act
Mandatory Reporting of Specific Drug Crimes
This provision mandates that electronic communication service providers and remote computing services (providers) must report to the Attorney General within 60 days of obtaining actual knowledge of facts or circumstances establishing a crime involving the unlawful sale, distribution, or manufacture of fentanyl, methamphetamine, counterfeit substances, or unauthorized prescription pain medication/stimulants. Providers may also report based on a reasonable belief.
Section 2(a)(1), adding Section 521(c) to the Controlled Substances Act
Required and Optional Information in Reports
Reports must include, to the extent available, identifying information about the account involved in the crime (e.g., name, address, IP address, user ID), but explicitly excluding the contents of wire or electronic communications, unless the provider chooses to include additional information. Optional information includes historical reference data, geographic location, and any data (symbols, photos, videos, direct messages) related to the crime, or even the complete communication.
Section 2(a)(1), adding Section 521(d) to the Controlled Substances Act
Attorney General's Review and Investigation Process
Upon receiving a report, the Attorney General must conduct a preliminary review. If the report contains sufficient information to warrant further investigation, the Attorney General may conduct such investigation or make the report available to other Federal, State, or local law enforcement agencies. Otherwise, the report is closed.
Section 2(a)(1), adding Section 521(e)(3) to the Controlled Substances Act
Data Minimization and Deletion for Reports
The Attorney General is required to take reasonable measures to limit the storage of reports and their contents to what is necessary for investigation and to store them only as long as reasonably necessary. After this period, the reports and contents must be deleted unless they have future evidentiary value.
Section 2(a)(1), adding Section 521(f) to the Controlled Substances Act
Criminal and Civil Penalties for Providers
Providers who knowingly fail to submit a required report face a criminal fine of up to $190,000 for an initial violation and up to $380,000 for subsequent violations. Providers who knowingly submit a report with materially false information or omit reasonably available required information face a civil penalty of $50,000 to $100,000.
Section 2(a)(1), adding Section 521(g) to the Controlled Substances Act
Explicit Protections Against Monitoring and Encryption Requirements
This section explicitly states that the Act does not require providers to monitor users or their communications, affirmatively search for violations, or decrypt encrypted communications. It also clarifies that actual knowledge cannot be proven solely by a provider's decision not to engage in additional verification if facts are not readily apparent, provided they don't deliberately blind themselves.
Section 2(a)(1), adding Section 521(i) to the Controlled Substances Act
Mandatory 90-Day Preservation of Reported Content
A submitted report automatically triggers a 90-day preservation requirement for the contents provided in the report and any reasonably accessible related data or digital files. The Attorney General can only request continued preservation beyond 90 days if there's an active investigation. Providers cannot notify users of preservation requests for 45 business days after notifying the Attorney General of their intent to do so.
Section 2(a)(1), adding Section 521(l) to the Controlled Substances Act
Exemption for Certain Service Providers
The reporting requirements (subsections b through k) do not apply to providers of broadband internet access service (as defined in 47 CFR 8.1(b)) or text messaging service (as defined in 47 U.S.C. 227(e)(8)), but only insofar as they are acting as providers of those specific services.
Prohibits Federal, Tribal, State, or local law enforcement officers from submitting reports to providers, or arranging for others to do so, under this section. Evidence derived from a provider's report that resulted from such a prohibited action is inadmissible in court.
Section 2(a)(1), adding Section 521(k) to the Controlled Substances Act
Why it matters:This is standard legislative practice to place procedural safeguards and limitations after the core operational requirements. It's a critical protection against potential abuse.
Case for: Supporters argue this is a vital safeguard to prevent law enforcement from circumventing legal processes (like warrants) by using the reporting mechanism as a backdoor for surveillance or information gathering, ensuring the integrity of the reporting system.
Case against: No direct case against this specific prohibition, as it is a protection against abuse. Some might argue it could limit proactive intelligence gathering, but the intent is to prevent abuse of the reporting mechanism.
Estimated impact: Prevents law enforcement from using the reporting system as an investigative tool, ensuring reports originate from providers' own discovery.
Amends Section 2702 of title 18, United States Code (the Stored Communications Act), to explicitly permit electronic communication service providers and remote computing services to disclose customer records and contents of communications to the Attorney General in connection with a report submitted under the new Section 521 of the Controlled Substances Act. It also clarifies an existing exception for inadvertent disclosures to law enforcement.
Section 2(b)
Why it matters:This is standard legislative practice for updating existing statutes to align with new legislation. It's technical but crucial for the new reporting requirements to function legally.
Case for: Proponents argue these amendments are absolutely necessary to ensure that providers can legally comply with the new reporting mandate without violating existing privacy laws like the Stored Communications Act, providing legal clarity and protection for companies.
Case against: Critics might argue that these amendments, by explicitly allowing disclosure, further erode digital privacy protections by creating another avenue for government access to user data, even if it's in response to a provider's own discovery.
Estimated impact: Legally enables the data sharing mandated by the bill, removing potential legal conflicts for providers.