ACCESS Act of 2025

This bill requires large online communications platforms to make user data portable and their services interoperable with competing providers, and to allow users to delegate account management to third-party agents, in order to promote competition and reduce switching costs. It is enforced by the Federal Trade Commission (FTC).

Sec. 2, Definitions: Defines key terms. 'Large communications platform' means a service with over 100 million monthly active U.S. users that generates income from user data. 'Large communications platform provider' is the company that runs such a platform. 'User data' is information linked to a specific person, excluding anonymized data. The FTC is the enforcing 'Commission'.

Sec. 3, Portability: Large platforms must provide interfaces (like APIs) to let users or competing providers, at the user's direction, securely transfer user data in a common, machine-readable format. Competing providers receiving that data must secure it. This does not apply to services that do not make money from user data.

Sec. 4, Interoperability: Large platforms must maintain interfaces so users of competing services can communicate with them. Large platforms must offer this on fair, reasonable, and nondiscriminatory terms, including possible fees proportional to cost. They must give functionally equivalent access as they give their own services, disclose interface documentation, and give advance notice of changes. Both large and competing providers cannot use data from the interface for their own commercial benefit. Exempts services that do not make money from user data.

Sec. 5, Delegatability: Large platforms must let users delegate a registered 'custodial third-party agent' to manage their account and content on the same terms as the user. The FTC will set rules for verifying such agents. Agents must safeguard user data, act in the user's interest, and not use data for their own commercial benefit. Agents may charge users fees. Platforms can deny access to unregistered or fraudulent agents.

Sec. 6, Implementation and Enforcement: The FTC must issue regulations within one year. The National Institute of Standards and Technology will develop technical standards for interoperability. The FTC will assess compliance, handle complaints, and enforce the Act as an unfair or deceptive practice, with fines per affected user. Using open standards creates a presumption of fair access. The Act preempts inconsistent state laws and takes effect when FTC regulations are issued.

Sec. 7, Relation to Other Laws: The Act does not change or override existing federal privacy and security laws, including the Privacy Act, HIPAA, COPPA, and others listed.