TLDR Act
- Sponsor
- Sen. Cassidy, Bill [R-LA]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Mar 10, 2025
Bottom line
The TLDR Act aims to enhance consumer understanding and transparency of online terms of service by requiring simplified summaries, visual data flow explanations, and interactive full texts, with enforcement by federal and state authorities.
What it actually does
This bill, known as the TLDR Act, mandates that the Federal Trade Commission (FTC) issue rules requiring online services and websites (covered entities) to provide short-form terms of service summary statements, graphic data flow diagrams, and full terms of service in an interactive data format. These summaries must be accessible, machine-readable, and include details on sensitive information processing, user liabilities, data breaches, and reading effort. The bill grants the FTC and state attorneys general enforcement authority.
Proponents argue
Proponents argue that current terms of service are often lengthy, complex, and inaccessible, leading users to unknowingly agree to unfavorable conditions regarding their data and rights. This bill would empower consumers by providing clear, concise, and understandable information, fostering greater trust and accountability in the digital economy. It addresses a fundamental imbalance of information between users and online service providers.
Opponents contend
Opponents might contend that the bill imposes significant regulatory burdens and compliance costs on covered entities, potentially stifling innovation, especially for larger tech companies. They may also argue that creating standardized summaries and diagrams for complex legal documents is challenging and could lead to oversimplification or misinterpretation, potentially increasing legal liability for companies without genuinely improving user understanding.
The bill itself is relatively short and straightforward, taking about 10-15 minutes to read. This contrasts sharply with the problem it seeks to solve: the often hours-long commitment required to read typical online terms of service.
Section 2(a)
FTC Rulemaking for Terms of Service Transparency
This provision requires the Federal Trade Commission (FTC) to issue rules within 360 days of the bill's enactment. These rules will compel 'covered entities' (online services and websites, excluding small businesses) to publish a truthful and non-misleading short-form terms of service summary statement, a graphic data flow diagram, and their full terms of service in an interactive data format on their websites.
Supporters argue
Supporters argue that mandating these transparency tools through FTC rulemaking is essential to ensure consistency and effectiveness across the industry, addressing the current lack of user-friendly information about complex legal agreements.
Critics contend
Critics may argue that broad rulemaking authority for the FTC could lead to overly prescriptive or burdensome regulations that do not adequately account for the diversity of online services and their business models.
Tradeoffs
This provision balances the need for regulatory oversight to ensure consumer protection against concerns about potential overregulation and the administrative burden on both the FTC and covered entities.
Section 2(c)
Requirements for Short-Form Summary Statement
This section details what the short-form summary statement must include. Key elements are categories of sensitive information processed, what sensitive information is essential for basic service vs. additional features, user legal liabilities (e.g., mandatory arbitration, class action waivers), licensing of user content, historical terms versions, data deletion instructions, a list of data breaches from the past three years, and an estimated reading time for the full terms of service.
Section 2(f)
Enforcement Mechanisms
This provision establishes how the Act will be enforced. Violations are treated as unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC full enforcement powers. Additionally, state attorneys general are authorized to bring civil actions on behalf of at least 1,000 residents of their state to enjoin violations, enforce compliance, and seek damages or restitution. States must notify the FTC before initiating such actions, and the FTC can intervene.
Section 2(g)
Definitions of Key Terms
This section defines critical terms used throughout the Act. 'Covered entity' refers to any person operating a commercial website or online service, explicitly excluding small business concerns. 'Sensitive information' is broadly defined to include health, biometric, precise geolocation, social security numbers, demographic data, communication content, audio/video recordings, financial information, and online browsing history. 'Interactive data format' is defined as an electronic format using standardized tags (like XML) to identify information.
The requirement to include a summary statement does not create any new contractual obligation.
Section 2(b)
Why it matters:This is standard legislative practice to clarify the legal effect of a new disclosure requirement, ensuring the summary is an informational tool rather than a new legal contract itself. It prevents unintended legal consequences.
Case for: Supporters would argue this clause is crucial to ensure the summary serves its intended purpose as an easily digestible overview without inadvertently altering the underlying legal agreement. It protects both users and entities from unintended contractual interpretations of the summary.
Case against: Critics might argue that by explicitly stating the summary creates no new contractual obligation, it subtly diminishes the summary's legal weight, potentially allowing entities to maintain problematic clauses in the full terms while presenting a more palatable summary. It could be seen as a way to limit accountability for the summary's content.
Estimated impact: This provision clarifies the legal standing of the summary statement, impacting how courts might interpret disputes arising from discrepancies between the summary and full terms.
The term 'covered entity' does not include a small business concern (as defined in section 3 of the Small Business Act (15 U.S.C. 632)).
Section 2(g)(2)(B)
Why it matters:This is a common legislative practice to provide relief to small businesses from regulatory burdens, often to avoid disproportionate impact on smaller entities that may lack the resources for extensive compliance.
Case for: Proponents would argue that exempting small businesses is essential to prevent undue financial and administrative burdens on entities that may not have the resources to comply with complex new disclosure requirements, thereby fostering small business growth and innovation.
Case against: Critics might contend that this exemption creates a loophole, allowing some online services, particularly those that grow quickly or serve niche markets, to operate without the same transparency standards, potentially leaving consumers using those services less protected.
Estimated impact: This exemption significantly reduces the scope of entities subject to the Act, potentially excluding thousands of smaller online businesses from compliance requirements.
Defines 'sensitive information' to include health, biometric, precise geolocation, social security numbers, demographic data (race, color, religion, national origin, sex, age, disability), communication content, audio/video recordings, financial information, and online browsing history across websites/services not owned by the covered entity.
Section 2(g)(7)
Why it matters:This is standard legislative practice to provide precise legal scope for terms used in the operative text. The detail is necessary for legal clarity and enforcement.
Case for: Supporters argue that a comprehensive definition of 'sensitive information' is critical to ensure that the most private and potentially exploitable data points are explicitly covered by the transparency requirements, preventing companies from selectively disclosing less impactful data.
Case against: Critics might argue that the breadth of this definition could be overly burdensome for companies, requiring extensive classification and disclosure for data types that may not always pose the same level of risk, or that some categories (like 'online browsing history') are too vague and difficult to precisely define for disclosure.
Estimated impact: This definition dictates the scope of data privacy disclosures for all covered entities, directly impacting how they categorize, process, and report on user data.