United StatesAI Accountability and Personal Data Protection Act
Introduced in the first chamber, dated , as of .
An AI training data rule binding private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
- Audit expectation
- none
As of .
Where it has got to
The text described here is S. 2367, 119th Congress, as introduced in the Senate (IS). That print is BILLS-119s2367is, published .
Locally, this stage is Introduced in the Senate; read twice and referred to the Committee on the Judiciary.
The stage above is recorded at www.congress.gov.
The bill page of congress.gov shows one version of the bill and one action, the referral to the Committee on the Judiciary on .
What it requires
- Do not appropriate, use, collect, process, sell, or otherwise exploit an individual's covered data, in or affecting interstate or foreign commerce, without the individual's express, prior consent (Section 3(a)).
- Do not train a generative artificial intelligence system that you sell, rent, license, or otherwise use on an individual's covered data without that individual's express, prior consent, and do not generate covered data pertaining to an individual, including content that imitates, replicates, or is substantially derived from the individual's covered data, without it (Section 2(1) with Section 3(a)).
- Treat covered data as information that can reasonably be linked to a specific individual, information derived, inferred, or generated from it, and material the individual created that is protected by copyright whether or not it is registered (Section 2(4)).
- Obtain consent as a clear, affirmative act made in advance, freely given, informed, and unambiguous, for the specific use (Section 2(5)); consent obtained through coercion or deception, or as a condition of using a product or service where the use exceeds what is reasonably necessary to provide it, is not valid (Section 3(b)(3)(B)).
- Where covered data goes to or is used by a third party, specifically and clearly disclose each third party to the individual when consent is sought, present the disclosure distinctly and separately from any privacy policy or terms of service, and do not rely on a hyperlink or a general reference to a privacy policy (Section 3(d)).
- Do not rely on a predispute arbitration agreement or a predispute joint-action waiver to avoid a claim under the Act; neither is valid or enforceable for it (Section 3(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
The $1,000 is the floor of a greater-of measure that also includes actual damages and treble the profits from the exploitation, so it is recoverable without proving loss. Punitive damages, injunctive relief, and attorney's fees and costs are recoverable besides.
- As of
- Currency
- USD
- Per person minimum
- 1,000
Who enforces it
Enforcement body
No agency; an individual whose covered data is exploited without express, prior consent enforces through a civil action in a United States district court or a State court of competent jurisdiction (Section 3(b)(1)).
What it makes you log
Logging duty
Section 3 creates a federal tort for exploiting covered data without express, prior consent, with a consent defense and rules on third-party disclosure. It requires no log, record, or audit report from a person it covers.
- Kind
- None
- As of
What this law does
The AI Accountability and Personal Data Protection Act, Senate bill 2367 of the 119th Congress, was introduced in the Senate on by Senator Hawley with Senator Blumenthal and referred to the Committee on the Judiciary.
It would make any person who, in or affecting interstate or foreign commerce, appropriates, uses, collects, processes, sells, or otherwise exploits an individual's covered data without the individual's express, prior consent liable to that individual, and it defines that conduct to include the training of a generative artificial intelligence system that the provider sells, rents, licenses, or otherwise uses, and the generation by such a system of covered data pertaining to an individual.
An individual could sue in a federal or State court and recover compensatory damages of the greater of actual damages, treble profits, or $1,000, plus punitive damages, injunctive relief, and attorney's fees, and a predispute arbitration agreement or joint-action waiver would not be enforceable for these claims.
When LexLint raises it
When your app profile says your app crawls the web, processes personal data or trains models.