1. Short title This Act may be cited as the Application Privacy, Protection, and Security Act of 2018 or the APPS Act of 2018 . 2. Transparency, user control, and security (a) Consent to terms and conditions (1) In general Before a mobile application collects personal data about a user of the application, the developer of the application shall— (A) provide the user with notice of the terms and conditions governing the collection, use, storage, and sharing of the personal data; and (B) obtain the consent of the user to such terms and conditions. (2) Required content The notice required by paragraph (1)(A) shall include the following: (A) The categories of personal data that will be collected. (B) The categories of purposes for which the personal data will be used. (C) The categories of third parties with which the personal data will be shared. (D) A data retention policy that governs the length for which the personal data will be stored and the terms and conditions applicable to storage, including a description of the rights of the user under subsection (b) and the process by which the user may exercise such rights. (3) Additional specifications and flexibility The Commission shall by regulation specify the format, manner, and timing of the notice required by paragraph (1)(A). In promulgating the regulations, the Commission shall consider how to ensure the most effective and efficient communication to the user regarding the treatment of personal data. (4) Direct access to data by third parties For purposes of this Act, if the developer of a mobile application allows a third party to access personal data collected by the application, such personal data shall be considered to be shared with the third party, whether or not such personal data are first transmitted to the developer. (b) Withdrawal of consent The developer of a mobile application shall— (1) provide a user of the application with a means of— (A) notifying the developer that the user intends to stop using the application