AI Accountability and Personal Data Protection Act
- Bill Number
- S. 2367
- Origin Chamber
- Senate
- Congress
- 119th Congress, Session 1
- Policy Area
- Law
- Status
- Introduced
- Latest Action
- 2025-07-21: Read twice and referred to the Committee on the Judiciary.
- Last Updated
- 2026-06-16T15:01:22Z
AI-Generated Summary
Purpose
The AI Accountability and Personal Data Protection Act aims to protect individuals' personal data by creating a federal legal claim (tort) against unauthorized collection, use, processing, sale, or other exploitation of that data, with a focus on artificial intelligence (AI) systems. It requires clear, advance permission from individuals before their data can be used, emphasizing consent in AI training and generation activities.
Key Provisions
- Definitions:
- "Covered data" includes any information that identifies or relates to a person (e.g., names, device IDs, location data, browsing history, biometrics, or even copyrighted works created by individuals). It also covers data derived from or inferred about a person.
- "Express, prior consent" means a clear, informed affirmative action by the individual before any data use, not obtained through tricks, force, or as a hidden condition of using a service.
- AI terms: "Artificial intelligence" refers to systems that perform tasks like humans (as defined in existing federal law); "generative AI" creates new content like text or images from prompts.
- Other terms cover data exploitation (including AI training) and agreements that limit lawsuits (e.g., forced arbitration or class action waivers).
- Federal Tort for Data Misuse:
- Any person or entity handling data in interstate or foreign commerce is liable if they use an individual's covered data without their express prior consent.
- Includes aiding others in such misuse and specifically targets AI systems training on or generating data from personal information.
- Private Right of Action:
- Affected individuals can sue in federal or state courts.
- Remedies include: actual damages or the greater of three times the violator's profits or $1,000; punitive damages (to punish bad behavior); court orders to stop the misuse; and coverage of legal fees.
- Defense: Proving valid consent, but consent is invalid if coerced, deceptive, or broader than needed for a service.
- Rules on Arbitration and Waivers:
- Bans pre-dispute arbitration agreements (contracts forcing disputes out of court before they arise) and waivers of group lawsuits (class or collective actions) for claims under this law.
- Courts, not arbitrators, decide if the law applies; such agreements are void as against public policy.
- Exception: Labor union contracts are unaffected, but workers can't waive constitutional or statutory rights.
- Third-Party Disclosures:
- Consent for sharing data with others requires naming each third party clearly and separately at the time of consent, not buried in fine print or links.
- Vague or passive disclosures (e.g., in privacy policies) don't count as valid consent.
- Relation to State Laws:
- Does not override stronger state privacy laws; acts as a baseline federal standard, allowing states to provide more protections.
Significant Changes to Existing Law
- Introduces a new federal tort specifically for data privacy violations, filling gaps in current laws like the Federal Trade Commission Act (which handles unfair practices but lacks a direct private lawsuit option for individuals).
- Overrides parts of the Federal Arbitration Act by making arbitration and class action bans unenforceable for these claims, shifting power from companies to courts and enabling group lawsuits.
- Expands "personal data" to include AI-generated or derived information and individual copyrights, going beyond narrower definitions in laws like HIPAA (health data) or COPPA (children's privacy).
Potential Impacts
- On Citizens: Empowers individuals to seek damages for data breaches or unauthorized AI uses (e.g., deepfakes from personal photos), potentially increasing privacy awareness and control over data.
- On Businesses and Tech Companies: Forces stricter consent practices, especially for AI firms training models on public or scraped data; could raise compliance costs and lead to more lawsuits, discouraging data-heavy business models.
- On Government Agencies: Minimal direct impact, but federal courts will handle more cases; agencies like the FTC may see indirect enforcement support.
- On International Relations: Applies to foreign commerce, so it could affect global tech firms operating in the U.S., potentially influencing data-sharing treaties or trade disputes over privacy standards.
Main Stakeholders Affected
- Individuals: Primary beneficiaries as data owners who can now sue directly for misuse.
- Tech and AI Companies: Entities collecting or using data (e.g., social media, AI developers like those behind chatbots or image generators) face new liability and consent requirements.
- Third Parties: Data buyers or partners (e.g., advertisers, data brokers) must be explicitly disclosed, limiting anonymous data markets.
- Legal System: Courts and lawyers, due to increased litigation and bans on arbitration.
- Labor Unions and Workers: Protected from waiving rights in employment contexts involving data.
Notable Legal, Constitutional, or Political Implications
- Legal: Establishes a uniform federal floor for data privacy torts, promoting consistency across states while allowing local variations; strengthens enforcement through private suits, reducing reliance on government regulators.
- Constitutional: Aligns with privacy expectations under the Fourth Amendment (protection from unreasonable searches) by mandating consent, but could face challenges if seen as limiting free speech in AI content generation or commerce under the First and Fifth Amendments (due process).
- Political: Bipartisan support (introduced by Senators Hawley and Blumenthal from opposing parties) signals broad concern over AI and data ethics; may spur further federal privacy reforms, but non-preemption preserves state-level experimentation (e.g., California's strict laws).
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (2)
Sen. Blumenthal, Richard [D-CT], Sen. Welch, Peter [D-VT]
Recent Actions
- 2025-07-21: Read twice and referred to the Committee on the Judiciary.
- 2025-07-21: Introduced in Senate
Bill Versions
- AI Accountability and Personal Data Protection Act — issued 2025-07-21 — PDF (11 pages)