ACCESS Act of 2025
Sponsored By: Senator Warner, Mark R. [D-VA]
Introduced
Summary
This bill creates a federal regime to force major online platforms to provide user-focused data portability and cross‑provider interoperability so people and competing services can move data and communicate across apps more easily. It also builds a system for trusted third parties to act on users' behalf under rules set by the Federal Trade Commission.**
Show full summary
- Users and households: Users can direct platforms to transfer their data to another service or to a registered custodial third‑party agent that will manage interactions for them. Covered platforms are those that earn income from user data and have more than 100,000,000 monthly U.S. users.
- Competing providers and custodial agents: Competing services that receive ported data must secure it and cannot monetize data obtained through the interoperability interface. Custodial agents must register with the FTC, follow privacy and security duties, and can charge fees for their services.
- Platforms, standards, and enforcement: Large platforms must expose APIs and publish interface documentation within 120 days after enactment and meet nondiscrimination, reasonable fees, and advance‑notice rules. The FTC issues implementing rules within 1 year and treats violations as unfair or deceptive acts with penalties applied per affected user. NIST will publish model technical standards within 180 days for messaging, multimedia sharing, and social networking.
- Legal scope: The law preempts inconsistent state rules and preserves existing federal privacy and security law coverage.
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
4 provisions identified: 4 benefits, 0 costs, 0 mixed.
FTC enforcement, state preemption, and privacy laws
If enacted, violations of this Act would count as unfair or deceptive acts under the FTC Act. The FTC would use its full enforcement powers, including over common carriers. The FTC would treat each harmed user as a separate violation for fines. The Commission would set complaint procedures for users, platforms, providers, and custodial agents. Federal law would override state law only when the state law conflicts with this Act. This Act would not change many federal privacy and security laws. Examples include the Privacy Act, COPPA, HIPAA rules, and the Fair Credit Reporting Act.
New rules for custodial agents
If enacted, the FTC would have 180 days to set rules for custodial-agent access and verification. The FTC would have one year to write implementing rules for interoperability and delegation. The Act would only take effect when the FTC issues those regulations. People could delegate access to registered custodial agents on the same terms they have. Custodial agents would need to register with the FTC before accessing delegation interfaces. Registered agents would have to protect user data and follow user directions. They could not collect, use, or share user data for their own commercial benefit. Custodial agents could charge users fees for delegated services.
NIST standards for platform interoperability
If enacted, NIST would have 180 days to publish model technical standards for interoperability. The standards must cover online messaging, multimedia sharing, and social networking. A large platform that uses a NIST open standard would get a rebuttable presumption its access terms are fair, reasonable, and nondiscriminatory.
Open interfaces and data portability for large platforms
If enacted, a "large communications platform" would be a service that makes money from user data. It would also have more than 100,000,000 monthly active U.S. users. Large platforms would have to give competing providers interface documentation within 120 days. They would have to keep APIs and interfaces that let other services interoperate. Users could get their data moved in structured, machine-readable formats. Platforms could set reasonable limits and charge fees beyond those limits. Any fees must match cost, complexity, and risk and be publicly noticed. Providers using interoperability interfaces would have to secure user data they get. Those providers could only use ported data to protect privacy, security, or keep interoperability. Portability rules would not apply to services that do not make money from user data.
Sponsors & CoSponsors
Sponsor
Warner, Mark R. [D-VA]
VA • D
Cosponsors
Sen. Hawley, Josh [R-MO]
MO • R
Sponsored 5/7/2025
Sen. Blumenthal, Richard [D-CT]
CT • D
Sponsored 5/7/2025
Roll Call Votes
No roll call votes available for this bill.
View on Congress.gov