Internet Application I.D. Act
- Sponsor
- Sen. Cortez Masto, Catherine [D-NV]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jan 12, 2026
Bottom line
This bill mandates transparency regarding foreign adversary ownership or data storage for internet services and mobile apps used by individuals in the United States, aiming to inform users about potential data security risks.
What it actually does
This bill mandates that owners, controllers, or distributors of internet websites and mobile applications (defined as 'covered services') must clearly disclose to U.S. users if the service is owned, wholly or partially, by a foreign adversary country or entity, or if user data is stored in such a country. It also requires disclosure if a foreign adversary country or entity has access to that information and makes knowingly false disclosures unlawful.
Proponents argue
Supporters argue this bill enhances national security by increasing transparency about foreign influence and data risks, empowering American users to make informed decisions about the digital services they use. It addresses concerns about foreign governments potentially accessing sensitive user data or influencing platforms, thereby protecting consumer privacy and national interests.
Opponents contend
Opponents might argue that the bill could lead to over-disclosure, create significant compliance burdens for legitimate businesses, or be perceived as discriminatory against certain foreign-owned entities, potentially hindering international digital commerce. They might also raise concerns about the practical enforceability and the potential for false positives in identifying 'foreign adversary country-owned entities' due to complex global corporate structures.
The bill is very short and easily digestible, allowing ample time for an an informed reader to understand its core provisions.
Section 2(a)
Mandatory Disclosure of Foreign Adversary Ownership or Data Storage
This provision mandates that, beginning one year after enactment, any person owning, controlling, or distributing a 'covered service' must clearly and conspicuously inform U.S. individuals if the service is owned by a foreign adversary country or entity, or if user data is stored in such a country. It also requires disclosure if a foreign adversary country or entity has access to that information, aiming to provide users with critical information about potential risks.
Supporters argue
Supporters argue this provision is crucial for national security and consumer protection, enabling users to understand potential risks associated with foreign adversary control over their data or digital platforms. It promotes transparency in the digital space, empowering users to make informed choices.
Critics contend
Critics might contend that this provision places an undue burden on businesses to determine complex ownership structures and data storage locations, potentially leading to over-disclosure or errors. They might also argue it could stigmatize foreign-owned companies without clear evidence of harm.
Tradeoffs
This provision balances national security and user transparency against potential compliance burdens for businesses and the risk of broad, potentially stigmatizing disclosures for foreign-owned entities.
Section 2(b)
Prohibition on Knowingly False Disclosures
This section makes it illegal for any person to intentionally provide incorrect or misleading information when making the disclosures required by the Act. This aims to ensure the integrity and reliability of the transparency mandates, holding entities accountable for the accuracy of the information they provide to users.
Section 2(c)
Definitions of Key Terms
This section defines critical terms that determine the scope of the bill. Key definitions include 'covered service' (internet website or mobile app owned by a foreign adversary entity or storing data in such a country), 'foreign adversary country' (referencing 10 U.S.C. 4872(f)(2)), 'individual' (natural person residing in the U.S.), and 'non-state-owned entity located in a foreign adversary country' (controlled by or organized under the laws of such a country).
Section 3
Enforcement by the Federal Trade Commission
This section designates violations of the Act as unfair or deceptive acts or practices under the Federal Trade Commission Act. It grants the FTC the authority to enforce the Act using its existing powers, duties, and penalties, ensuring a clear regulatory framework for compliance, investigation, and redress for non-compliance.
Defines 'foreign adversary country' by reference to an existing statute, specifically section 4872(f)(2) of title 10, United States Code.
Section 2(c)(2)
Why it matters:This is standard legislative practice to avoid redundancy and maintain consistency with existing national security definitions already established in U.S. law.
Case for: Ensures consistency with existing national security definitions and avoids creating a new, potentially conflicting list of adversaries, streamlining legal interpretation across different statutes.
Case against: Requires external research for a full understanding of the bill's scope, making the bill less self-contained and potentially more difficult for the average reader or even some legal professionals to fully grasp without additional investigation.
Estimated impact: Directly determines the scope of countries whose ownership or data storage triggers disclosure requirements, which is central to the bill's purpose and its impact on international businesses.
Defines 'controlled' within the definition of 'non-state-owned entity located in a foreign adversary country' by referencing section 800.208 of title 31, Code of Federal Regulations, or a successor regulation.
Section 2(c)(4)(A)
Why it matters:This is standard legislative practice to leverage existing, detailed regulatory definitions for complex concepts like 'control' in national security contexts, drawing on established expertise from foreign investment review processes.
Case for: Provides a robust and well-established legal framework for determining control, drawing on expertise from foreign investment review, which is crucial for accurately identifying entities subject to the bill.
Case against: Adds significant complexity for compliance, requiring businesses to understand a detailed regulatory definition that may not be immediately obvious or easily accessible, potentially increasing legal and due diligence costs.
Estimated impact: Crucial for determining which private entities in foreign adversary countries are subject to the disclosure requirements, significantly impacting the bill's reach and the number of entities affected.