Cooper Davis and Devin Norring Act

Reduction of illegal drug proliferation: The duty to report is intended to reduce the unlawful sale, distribution, or manufacture of counterfeit substances and certain controlled substances like fentanyl and methamphetamine (Section 2(b)(1)).

Data privacy protections for providers: The law does not require a provider to monitor users, monitor the content of communications, or affirmatively search or scan for these specific crimes (Section 2(g)).

Preservation of encryption: The bill does not prohibit a provider from using end-to-end encryption or require them to decrypt communications (Section 2(g)(5)).

Accountability through public reporting: The Attorney General is required to publish an annual report detailing the number of reports received and the outcomes of investigations (Section 2(j)).

Data minimization: The Attorney General must take reasonable measures to limit the storage of reports to only what is necessary for investigations (Section 2(e)(3)(A)).

Financial penalties for service providers: Providers that knowingly fail to submit required reports can be fined up to $190,000 for an initial violation and up to $380,000 for subsequent violations (Section 2(f)(1)).

Civil liability for providers: Providers may face civil penalties between $50,000 and $100,000 if they submit reports containing materially false information or omit required identifying information (Section 2(f)(2)).

Information disclosure to law enforcement: While law enforcement cannot submit reports, they can disclose information from received reports to government attorneys, employees, and other government personnel (Section 2(h)(2)).

Data preservation requirements: A report submitted by a provider acts as a request to preserve the reported contents and any related digital files for 90 days (Section 2(i)(1)(A)(i)).