Social Media Privacy Protection and Consumer Rights Act of 2018

This bill requires online platform operators to inform a user, prior to a user creating an account or otherwise using the platform, that the user's personal data produced during online behavior will be collected and used by the operator and third parties. The operator must provide a user the option to specify privacy preferences, and an operator may deny certain services or complete access to a user if the user's privacy elections create inoperability in the platform.

The operator must: (1) offer a user a copy of the personal data of the user that the operator has processed, free of charge, and in an electronic format; and (2) notify a user within 72 hours of becoming aware that the user's data has been transmitted in violation of the security platform.

A violation of the bill's privacy requirements shall be considered an unfair or deceptive act or practice under the Federal Trade Commission Act. The Federal Trade Commission (FTC) may enforce this bill against common carriers regulated by the Federal Communications Commission under the Communications Act of 1934 and nonprofit organizations. (Currently, common carriers regulated under that Act are exempt from the FTC's enforcement authority, and nonprofit organizations are subject to FTC enforcement only if they provide substantial economic benefit to their for-profit members.)

A state may bring a civil action in federal court regarding such violations.