S2316-119

What This Bill Does

The Cooper Davis and Devin Norring Act requires electronic communication service providers (such as social media platforms, email services, and messaging apps) and remote computing services (such as cloud storage providers) to report suspected drug trafficking to the Attorney General. Specifically, providers must report within 60 days when they have actual knowledge of illegal activity involving fentanyl, methamphetamine, counterfeit drugs, or unauthorized distribution of prescription pain medications and stimulants occurring on their platforms.

Who Benefits and How

Law enforcement agencies benefit significantly, as they gain a new channel of intelligence from tech companies to help combat online drug trafficking, particularly for fentanyl and methamphetamine. The Attorney General and DEA receive direct reports with detailed user information, IP addresses, and communication data that can be shared with federal, state, and local law enforcement. Families affected by drug overdoses (the bill is named after overdose victims Cooper Davis and Devin Norring) may benefit from increased detection and prosecution of online drug dealers.

Who Bears the Burden and How

Tech companies and online platforms face significant new compliance obligations. They must establish reporting systems to the Attorney General, preserve reported data for 90 days, and risk substantial penalties: up to ,000 for a first violation and ,000 for subsequent violations of reporting requirements. Companies may also face ,000-,000 civil penalties for false or incomplete reports. Platform users may experience increased privacy concerns, as their account information, IP addresses, communications, and location data can be disclosed to law enforcement without a warrant when providers make reports.

Key Provisions

• Mandatory Reporting: Providers must report to the Attorney General within 60 days of gaining actual knowledge of drug trafficking involving fentanyl, methamphetamine, counterfeit substances, or unauthorized prescription drugs
• Detailed Disclosure: Reports must include user account information, IP addresses, screen names, and may include full communications, photos, videos, and direct messages at the provider's discretion
• Penalties: Criminal fines up to ,000 (first offense) or ,000 (repeat offenses) for failure to report; civil penalties of ,000-,000 for false or incomplete reports
• Data Preservation: Providers must preserve reported content and related data for 90 days; law enforcement can request extended preservation for active investigations
• Privacy Protections: Providers are not required to proactively monitor users, scan for violations, or break end-to-end encryption; the bill only applies when providers obtain "actual knowledge"
• Exemptions: Broadband internet access service providers and text messaging services are exempt from reporting requirements
• Law Enforcement Prohibition: Police officers cannot submit or arrange for false reports to providers, and evidence from such prohibited reports is inadmissible in court