S06686 Summary:

BILL NOS06686
 
SAME ASNo Same As
 
SPONSORHOYLMAN-SIGAL
 
COSPNSR
 
MLTSPNSR
 
Add Art 42 1100 - 1104, Gen Bus L
 
Relates to social media open application programming; requires social media platforms to implement and maintain a standards-based application programming interface that permits third-party applications to retrieve data at no cost to be used for the user's benefit and to provide certain information to users; requires social media companies to submit a report to the attorney general.
Go to top    

S06686 Actions:

BILL NOS06686
 
05/05/2023REFERRED TO INTERNET AND TECHNOLOGY
01/03/2024REFERRED TO INTERNET AND TECHNOLOGY
Go to top

S06686 Committee Votes:

Go to top

S06686 Floor Votes:

There are no votes for this bill in this legislative session.
Go to top

S06686 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                          6686
 
                               2023-2024 Regular Sessions
 
                    IN SENATE
 
                                       May 5, 2023
                                       ___________
 
        Introduced  by Sen. HOYLMAN-SIGAL -- read twice and ordered printed, and
          when printed to be committed to the Committee on Internet and Technol-
          ogy
 
        AN ACT to amend the general business law, in relation  to  social  media
          open application programming
 
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:
 
     1    Section 1.  The general business law is amended by adding a new  arti-
     2  cle 42 to read as follows:
     3                                  ARTICLE 42
     4                  SOCIAL MEDIA OPEN APPLICATION PROGRAMMING
     5                              INTERFACE ACCESS
     6  Section 1100. Definitions.
     7          1101. Required open API access with social media for third-party
     8          development tools.
     9          1102. API access report.
    10          1103. Violations and remedies.
    11          1104. Application.
    12  § 1100. Definitions. As used in this article:
    13    1.  "Application  programming  interface"  or "API" means a standards-
    14  based interface that permits third-party applications to  retrieve  data
    15  and  send  instructions  through the use of non-proprietary technologies
    16  that are commonly used and recognized by businesses on behalf of a  user
    17  or authorized representative with no special effort.
    18    2. "Authorized representative" means a person who has received written
    19  authorization  from  a  user  to  take  actions on behalf of a user on a
    20  social media platform.
    21    3. "Content" means statements or comments made by users and media that
    22  are created, posted, shared, or otherwise interacted with by users on an
    23  internet-based service or application. "Content" does not include  media
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD11044-01-3

        S. 6686                             2
 
     1  put  on  a  service  or application exclusively for the purpose of cloud
     2  storage, transmitting files, or file collaboration.
     3    4.  "Public  or  semipublic  internet-based  service  or  application"
     4  excludes a service or application used to facilitate communication with-
     5  in a business or enterprise among employees or affiliates of  the  busi-
     6  ness  or  enterprise, provided that access to the service or application
     7  is restricted to employees or affiliates of the business  or  enterprise
     8  using the service or application.
     9    5.  "Social media company" means a person or entity that owns or oper-
    10  ates one or more social media platforms.
    11    6. "Social media platform" means a public or semipublic internet-based
    12  service or application that has users in New York and that meets both of
    13  the following criteria:
    14    (a) A substantial function of the service or application is to connect
    15  users in order to allow users to interact socially with each other with-
    16  in the service or application. A service or  application  that  provides
    17  email  or direct messaging services shall not be considered to meet this
    18  criterion on the basis of that function alone.
    19    (b) The service or application allows users to do all of  the  follow-
    20  ing:
    21    (i)  construct  a public or semipublic profile for purposes of signing
    22  into and using the service or application;
    23    (ii) populate a list of other users with whom an individual  shares  a
    24  social connection within the system; and
    25    (iii)  create  or post content viewable by other users, including, but
    26  not limited to, on message boards, in chat rooms, or through  a  landing
    27  page or main feed that presents the user with content generated by other
    28  users.
    29    § 1101. Required  open  API  access  with social media for third-party
    30  development tools. 1. A social media platform must implement  and  main-
    31  tain  a  standards-based  application programming interface that permits
    32  third-party applications to retrieve data specified in  subdivision  two
    33  of this section at no cost, and for a user or a user's authorized repre-
    34  sentative, to be used for the user's benefit.
    35    2.  A  social media platform must provide the following information to
    36  its current users or their authorized representatives  through  the  API
    37  consistent with subdivision one of this section:
    38    (a)  The user's personal data that the social media platform controls,
    39  including, without limitation:
    40    (i) data generally available  to  account  holders,  including  user's
    41  name, username or handle, profile photo, bio, and location;
    42    (ii) user data or data based on actions taken by the user generated by
    43  a  user  collected by the social media platform that forms the basis for
    44  social recommendations, including without limitation  user  follows  and
    45  publicly available follower data, as well as the social recommendations,
    46  groups, topics, boards, and hashtags, users may follow;
    47    (iii)  third-party data which is either (A) generally available to all
    48  account holders, or (B) made available to the user by the action of that
    49  third party, and which is collected by the social media company to  make
    50  content decisions that directly or indirectly impact a user; and
    51    (iv)  user  settings,  including  notification  and  privacy settings,
    52  muted/blocked accounts and keywords.
    53    (b) Social media platform produced or recommended data that is  avail-
    54  able to the user, including without limitation:

        S. 6686                             3
 
     1    (i)  content that is directed or recommended to the user by the social
     2  media platform in surface areas, including direct messages, comments  on
     3  user posts, mentions, tagged comments, and tagged stories;
     4    (ii)  social media platform produced data or compilations of data that
     5  is visible in personalized surface areas, including timeline and  recom-
     6  mendations;
     7    (iii)  content  freely  available  to  a  user as a result of a user's
     8  actions, including content generally available to groups,  servers,  and
     9  communities joined by the user; and
    10    (iv) notifications regarding actions on the social media platform.
    11    (c)  Data that is generally available to all account holders about the
    12  user's friends or followers that the social media platform uses to  make
    13  filtering  or  ranking  decisions relating to a user, including, without
    14  limitation, data that is available to the user about other  accounts  on
    15  the  platform,  including  name,  username  or handle, profile photo and
    16  number of followers or persons following.
    17    3. A social media platform must provide access through the API  neces-
    18  sary  to allow third-party applications on behalf of any current user to
    19  write, update or take action on:
    20    (a) The user's personal data that the social media platform  controls,
    21  including, without limitation:
    22    (i) data that is generally available to all account holders, including
    23  user's name, username or handle, profile photo, bio, and location;
    24    (ii)  user  data  and  data  generated  by a user and collected by the
    25  social media platform that forms the basis for  social  recommendations,
    26  including  user  follows  and follower data, as well as the topics users
    27  may follow;
    28    (iii) third-party data which is either (A) generally available to  all
    29  account  holders,  or  (B)  made  available to user by the action of the
    30  third party, and which is collected by the social media company to  make
    31  user safety decisions, including who users block and mute; and
    32    (iv)  user  settings, including notification and privacy settings, and
    33  muted/blocked keywords.
    34    (b) All safety or preference controls that can  be  applied  to  other
    35  users  and  content,  including,  without  limitation, muting, blocking,
    36  reporting, hiding comments  or  replies,  accepting  user  requests,  or
    37  related controls.
    38    4. A social media platform must conduct routine testing, conducted not
    39  less  than  quarterly,  conduct ongoing monitoring, and make all updates
    40  necessary to ensure the API functions properly, including:
    41    (a) Assessments to verify that  the  API  is  fully  and  successfully
    42  implementing privacy and security features.
    43    (b) A status dashboard to allow developers to determine the operation-
    44  ality of the API.
    45    (c)  Functionality  to  enable piecewise retrieval of large data sets,
    46  including filtering, sorting, and pagination, or ability to query deltas
    47  since a given timestamp.
    48    (d) Maximum latency thresholds necessary to allow developers to access
    49  any required data in a reasonable manner.
    50    (e) Reasonable error handling, including standard error codes.
    51    (f) Versioning of the API.
    52    5. A social media platform must make publicly accessible,  by  posting
    53  directly on its website or via a publicly accessible hyperlink or hyper-
    54  links,  complete  accompanying  documentation  reasonably  necessary for
    55  developers to access the API. This documentation shall include,  without
    56  limitation:

        S. 6686                             4

     1    (a)  API  syntax,  function  names,  required  and optional parameters
     2  supported  and  their   data   types,   return   variables   and   their
     3  types/structures,  exceptions  and  exception handling methods and their
     4  returns, as well as sample data for each data type.
     5    (b) The software components and configurations an application must use
     6  in  order to successfully interact with the API and process its response
     7  or responses.
     8    (c) All applicable technical requirements and attributes necessary for
     9  an application to be registered with any authorization server or servers
    10  deployed in conjunction with the API.
    11    (d) Change logs for any updates to the API.
    12    6. A social media platform may deny or discontinue any user or author-
    13  ized representative's application's access to the API if:
    14    (a) the social media platform reasonably determines,  consistent  with
    15  access  requirements  clearly  established  in its terms and conditions,
    16  that allowing a user or authorized representative to connect  or  remain
    17  connected  to the API would present an unacceptable level of risk to the
    18  security of the social media platform or its users; and
    19    (b) the social media platform makes this  determination  using  objec-
    20  tive,  verifiable  criteria  that  are  applied  fairly and consistently
    21  across all applications and developers  through  which  users  may  seek
    22  access  to  the  platform;  provided that the social media platform must
    23  retain records of any decision to restrict API access  to  any  user  or
    24  authorized  representative,  including  the user, date, time, documented
    25  misuse and record of notification of violation.
    26    § 1102. API access report. 1. On a semiannual basis in accordance with
    27  subdivision two of this section, a social media company shall submit  to
    28  the  attorney  general an API access report. The API access report shall
    29  include, for each social media platform owned or operated by the  compa-
    30  ny, information on API utilization and access decisions made pursuant to
    31  section eleven hundred one of this article, including all of the follow-
    32  ing:
    33    (a) the current features included in the API;
    34    (b)  if  a social media company has filed its first report, a complete
    35  and detailed description of any changes to the API  since  the  previous
    36  report;
    37    (c)  a  detailed  description  of  how  the  social  media company has
    38  responded to additional features added to the platform since the  previ-
    39  ous API access report; and
    40    (d)  any denials or discontinuations of any person to the API, includ-
    41  ing a complete and detailed description of the bases for such denial  or
    42  discontinuation.
    43    2. (a) A social media company shall electronically submit a semiannual
    44  API  access report pursuant to subdivision one of this section, covering
    45  activity within the third and fourth quarters of the preceding  calendar
    46  year,  to  the  attorney general no later than April first of each year,
    47  and shall electronically submit a semiannual API access report  pursuant
    48  to  subdivision  one of this section, covering activity within the first
    49  and second quarters of the current calendar year, to the attorney gener-
    50  al no later than October first of each year.
    51    (b) Notwithstanding paragraph (a) of this subdivision, a social  media
    52  company shall electronically submit its first API access report pursuant
    53  to  subdivision  one of this section, covering activity within the third
    54  quarter of two thousand twenty-four, to the attorney  general  no  later
    55  than  January  first, two thousand twenty-five, and shall electronically
    56  submit its second API access report pursuant to subdivision one of  this

        S. 6686                             5
 
     1  section,  covering  activity  within  the fourth quarter of two thousand
     2  twenty-four, to the attorney general no  later  than  April  first,  two
     3  thousand  twenty-five.  A  social  media platform shall submit its third
     4  report no later than October first, two thousand twenty-five, in accord-
     5  ance with paragraph (a) of this subdivision.
     6    3.  The  attorney  general shall make all API access reports submitted
     7  pursuant to this section available to the public in a searchable reposi-
     8  tory on its official internet website.
     9    § 1103. Violations and remedies. 1. (a) A social  media  company  that
    10  violates  the provisions of this article may be enjoined in any court of
    11  competent jurisdiction.
    12    (b) A social media company shall be considered  in  violation  of  the
    13  provisions  of  this article if the social media company does any of the
    14  following:
    15    (i) fails to provide or maintain open API access  in  accordance  with
    16  section eleven hundred one of this article;
    17    (ii)  fails  to timely submit to the attorney general reports required
    18  pursuant to section eleven hundred two of this article; or
    19    (iii) materially omits or  misrepresents  required  information  in  a
    20  report submitted pursuant to section eleven hundred two of this article.
    21    2.  Actions  for  relief  pursuant to this article shall be prosecuted
    22  exclusively in a court of competent jurisdiction by the attorney general
    23  in the name of the people of the state of New York or a city corporation
    24  counsel on behalf of a locality upon their own  complaint  or  upon  the
    25  complaint of a board, officer, person, corporation, or association.
    26    § 1104. Application.  This  article  shall not apply to a social media
    27  company that generated less than one hundred million  dollars  in  gross
    28  revenue  during  the  preceding  calendar  year  or to an internet-based
    29  service or application for which interactions between users are  limited
    30  to   direct  messages,  commercial  transactions,  consumer  reviews  of
    31  products, sellers, services, events, or places, or any combination ther-
    32  eof.
    33    § 2. This act shall take effect on the one hundred eightieth day after
    34  it shall have become a law.
Go to top