WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
This Act may be cited as the ''AI Accountability and Personal Data Protection Act''.
Establishes the short title of the Act as the AI Accountability and Personal Data Protection Act. No compliance obligations are imposed.
(1) APPROPRIATE, USE, COLLECT, PROCESS, SELL, OR OTHERWISE EXPLOITAppropriate, use, collect, process, sell, or otherwise exploitThe term "appropriate, use, collect, process, sell, or otherwise exploit" includes— (A) the training of a generative artificial intelligence system that is sold, rented, licensed, or otherwise used by the provider of the generative artificial intelligence system; and (B) the generation, by a generative artificial intelligence system, of any covered data that pertains to an individual, including content that imitates, replicates, or is substantially derived from the covered data of the individual.Sec. 2(1).—The term ''appropriate, use, collect, process, sell, or otherwise exploitAppropriate, use, collect, process, sell, or otherwise exploitThe term "appropriate, use, collect, process, sell, or otherwise exploit" includes— (A) the training of a generative artificial intelligence system that is sold, rented, licensed, or otherwise used by the provider of the generative artificial intelligence system; and (B) the generation, by a generative artificial intelligence system, of any covered data that pertains to an individual, including content that imitates, replicates, or is substantially derived from the covered data of the individual.Sec. 2(1)'' includes— (A) the training of a generative artificial intelligence systemGenerative artificial intelligence systemThe term "generative artificial intelligence system" means an artificial intelligence system that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.Sec. 2(6) that is sold, rented, licensed, or otherwise used by the provider of the generative artificial intelligence systemGenerative artificial intelligence systemThe term "generative artificial intelligence system" means an artificial intelligence system that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.Sec. 2(6); and (B) the generation, by a generative artificial intelligence systemGenerative artificial intelligence systemThe term "generative artificial intelligence system" means an artificial intelligence system that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.Sec. 2(6), of any covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) that pertains to an individual, including content that imitates, replicates, or is substantially derived from the covered data of the individual.
(2) ARTIFICIAL INTELLIGENCEArtificial intelligenceThe term "artificial intelligence" has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Sec. 2(2).—The term ''artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Sec. 2(2)'' has the meaning given that term in section 5002 of the National Artificial IntelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Sec. 2(2) Initiative Act of 2020 (15 U.S.C. 9401).
(3) ARTIFICIAL INTELLIGENCE SYSTEMArtificial intelligence systemThe term "artificial intelligence system" means any data system, software, hardware, application, tool, or utility that operates, in whole or in part, using artificial intelligence.Sec. 2(3).—The term ''artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means any data system, software, hardware, application, tool, or utility that operates, in whole or in part, using artificial intelligence.Sec. 2(3)'' means any data system, software, hardware, application, tool, or utility that operates, in whole or in part, using artificial intelligenceArtificial intelligenceThe term "artificial intelligence" has the meaning given that term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).Sec. 2(2).
(4) COVERED DATACovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4).—The term ''covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4)''— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable informationPersonally identifiable informationThe term "personally identifiable information" means information that can be used to distinguish or trace the identity of an individual, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.Sec. 2(7); (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.
(5) EXPRESS, PRIOR CONSENTExpress, prior consentThe term "express, prior consent" means a clear, affirmative act by an individual, made in advance of any appropriation, use, collection, processing, sale, or other exploitation of covered data, indicating a freely given, informed, and unambiguous consent to the specific appropriation, use, collection, processing, sale, or other exploitation of covered data of the individual.Sec. 2(5).—The term ''express, prior consentExpress, prior consentThe term "express, prior consent" means a clear, affirmative act by an individual, made in advance of any appropriation, use, collection, processing, sale, or other exploitation of covered data, indicating a freely given, informed, and unambiguous consent to the specific appropriation, use, collection, processing, sale, or other exploitation of covered data of the individual.Sec. 2(5)'' means a clear, affirmative act by an individual, made in advance of any appropriation, use, collection, processing, sale, or other exploitation of covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4), indicating a freely given, informed, and unambiguous consent to the specific appropriation, use, collection, processing, sale, or other exploitation of covered data of the individual.
(6) GENERATIVE ARTIFICIAL INTELLIGENCE SYSTEMGenerative artificial intelligence systemThe term "generative artificial intelligence system" means an artificial intelligence system that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.Sec. 2(6).—The term ''generative artificial intelligence systemGenerative artificial intelligence systemThe term "generative artificial intelligence system" means an artificial intelligence system that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.Sec. 2(6)'' means an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means any data system, software, hardware, application, tool, or utility that operates, in whole or in part, using artificial intelligence.Sec. 2(3) that is capable of generating novel text, video, images, audio, and other media based on prompts or other forms of data provided by an individual.
(7) PERSONALLY IDENTIFIABLE INFORMATIONPersonally identifiable informationThe term "personally identifiable information" means information that can be used to distinguish or trace the identity of an individual, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.Sec. 2(7).—The term ''personally identifiable informationPersonally identifiable informationThe term "personally identifiable information" means information that can be used to distinguish or trace the identity of an individual, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.Sec. 2(7)'' means information that can be used to distinguish or trace the identity of an individual, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.
(8) PREDISPUTE ARBITRATION AGREEMENTPredispute arbitration agreementThe term "predispute arbitration agreement" means an agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(8).—The term ''predispute arbitration agreementPredispute arbitration agreementThe term "predispute arbitration agreement" means an agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(8)'' means an agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement.
(9) PREDISPUTE JOINT-ACTION WAIVERPredispute joint-action waiverThe term "predispute joint-action waiver" means an agreement, whether or not part of a predispute arbitration agreement, that would prohibit, or waive the right of, one of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other forum, concerning a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(9).—The term ''predispute joint-action waiverPredispute joint-action waiverThe term "predispute joint-action waiver" means an agreement, whether or not part of a predispute arbitration agreement, that would prohibit, or waive the right of, one of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other forum, concerning a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(9)'' means an agreement, whether or not part of a predispute arbitration agreementPredispute arbitration agreementThe term "predispute arbitration agreement" means an agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(8), that would prohibit, or waive the right of, one of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other forum, concerning a dispute that has not yet arisen at the time of the making of the agreement.
Section 2 defines nine terms used throughout the Act. The most consequential are covered data, which sweeps in any information linkable to a specific individual plus copyrighted works generated by an individual, and appropriate, use, collect, process, sell, or otherwise exploit, which explicitly includes AI training and AI-generated outputs that imitate or replicate an individual's data. The definition of express, prior consent sets a high bar: consent must be a clear, affirmative act given in advance and specific to the particular use.
(a) 1 LIABILITY.—Any person who, in or affecting interstate or foreign commerce, appropriates, uses, collects, processes, sells, or otherwise exploits the covered data of an individual, without the express, prior consent of the individual, shall be liable to the individual in accordance with this section.
(b)(1) 1 IN GENERAL.—Any individual whose covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) is appropriated, used, collected, processed, sold, or otherwise exploited without the express, prior consent of the individual as described in subsection (a) may bring a civil action in an appropriate district court of the United States or a State court of competent jurisdiction against any person who— (A) engaged in the appropriation, use, collection, processing, sale, or other exploitation of the covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4); or (B) aided and abetted another person in the appropriation, use, collection, processing, sale, or other exploitation of the covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4).
(b)(2) 1 REMEDIES.—An individual prevailing in a civil action brought under paragraph (1) may recover— (A) compensatory damages in an amount equal to the greater of— (i) actual damages; (ii) treble any profits from the appropriation, use, collection, processing, sale, or other exploitation of the covered data of the individual as described in subsection (a); or (iii) $1,000; (B) punitive damages; (C) injunctive relief; and (D) attorney's fees and costs.
(b)(3) 1 IN GENERAL.—It shall be an affirmative defense to a civil action under paragraph (1) brought by or on behalf of an individual whose covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) was appropriated, used, collected, processed, sold, or otherwise exploited if the defendant demonstrates that the individual provided express, prior consentExpress, prior consentThe term "express, prior consent" means a clear, affirmative act by an individual, made in advance of any appropriation, use, collection, processing, sale, or other exploitation of covered data, indicating a freely given, informed, and unambiguous consent to the specific appropriation, use, collection, processing, sale, or other exploitation of covered data of the individual.Sec. 2(5) for such appropriation, use, collection, processing, sale, or other exploitation of the covered data of the individual. (B) INVALID GROUNDS FOR CONSENT.—Consent to the appropriation, use, collection, processing, sale, or other exploitation of covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) shall not be deemed valid if such consent was obtained— (i) through coercion or deception; or (ii) as a condition of using a product or service through which the appropriation, use, collection, processing, sale, or other exploitation of the covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) exceeds what is reasonably necessary to provide that product or service.
(c)(1)–(3) 2 IN GENERAL.—Notwithstanding any other provision of law, including chapter 1 of title 9, United States Code (commonly known as the ''Federal Arbitration Act''), a predispute arbitration agreementPredispute arbitration agreementThe term "predispute arbitration agreement" means an agreement to arbitrate a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(8) or predispute joint-action waiverPredispute joint-action waiverThe term "predispute joint-action waiver" means an agreement, whether or not part of a predispute arbitration agreement, that would prohibit, or waive the right of, one of the parties to the agreement to participate in a joint, class, or collective action in a judicial, arbitral, administrative, or other forum, concerning a dispute that has not yet arisen at the time of the making of the agreement.Sec. 2(9) shall not be valid or enforceable with respect to any claim arising under this Act. (2) UNENFORCEABLE AGREEMENTS.—Any agreement purporting to waive, limit, or preclude the right of an individual to bring an action in a court of law or to participate in a joint, class, collective, or representative action concerning any claim arising under this Act shall be deemed contrary to public policy and shall be null, void, and unenforceable. (3) DETERMINATION UNDER FEDERAL LAW BY FEDERAL COURT.—An issue as to whether this Act applies with respect to a dispute shall be determined under Federal law. The applicability of this Act to an agreement to arbitrate and the validity and enforceability of an agreement to which this Act applies shall be determined by a court, rather than an arbitrator, irrespective of whether the party resisting arbitration challenges the arbitration agreement specifically or in conjunction with other terms of the contract containing such agreement, and irrespective of whether the agreement purports to delegate such determinations to an arbitrator.
(c)(4) COLLECTIVE BARGAINING AGREEMENTS.—Nothing in this Act shall apply to any arbitration provision in a contract between an employer and a labor organization or between labor organizations, except that no such arbitration provision shall have the effect of waiving the right of a worker to seek judicial enforcement of a right arising under a provision of the Constitution of the United States, a State constitution, or a Federal or State statute, or public policy arising therefrom.
(d)(1)–(3) 3 IN GENERAL.—Consent required under subsection (a) shall not be valid for the appropriation, use, collection, processing, sale, or other exploitation of covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) by or to any third party unless— (A) each third party is specifically and clearly disclosed to the individual to whom the covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) pertains at the time consent is sought; and (B) the disclosure described in subparagraph (A) is affirmatively presented to the individual to whom the covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) pertains in a manner that ensures the disclosure is seen and acknowledged. (2) PRESENTATION.—Any disclosure described in paragraph (1)— (A) shall be presented distinctly and separately from any privacy policy, terms of service, or other general conditions or agreements; and (B) shall not be satisfied by the mere inclusion of a hyperlink or general reference to a privacy policy, user agreement, or other similar document. (3) INVALID CONSENT.—Any purported consent for the appropriation, use, collection, processing, sale, or other exploitation of covered dataCovered dataThe term "covered data"— (A) means any information, data, or material, regardless of form or format, that— (i) identifies, relates to, describes, is capable of being associated with, or can reasonably be linked, directly or indirectly, with a specific individual; (ii) is derived, inferred, or generated from information described in clause (i), or is used to derive, infer, or generate information described in clause (i); or (iii) is generated by an individual and is protected by copyright, regardless of whether the copyright has been registered with the United States Copyright Office or any other registration authority; and (B) includes— (i) personally identifiable information; (ii) unique identifiers, such as device IDs, advertising IDs, or IP addresses; (iii) geolocation data; (iv) biometric information; (v) behavioral data, such as browsing history or purchasing patterns; or (vi) inferred, derived, or predicted data used to create a profile about an individual or group of individuals.Sec. 2(4) by or to any third party obtained solely by inclusion within such general documents described in paragraph (2) or via non-specific or passive disclosure shall be invalid and unenforceable.
Section 3 is the operative heart of the bill. Subsection (a) establishes the core liability rule: any person who appropriates, uses, collects, processes, sells, or otherwise exploits an individual's covered data without express, prior consent is liable. Because the defined term explicitly includes AI training and AI-generated imitative outputs, this creates strict liability for GenAI providers who train on or generate content derived from individuals' data without obtaining affirmative opt-in consent.
Subsection (b) creates a private right of action with robust remedies — compensatory damages at the greater of actual damages, treble profits, or $1,000; plus punitive damages, injunctive relief, and attorney's fees. The affirmative defense of consent is narrowed by invalidity rules: consent obtained through coercion, deception, or as a condition of service beyond what is reasonably necessary is void. Subsection (c) categorically renders predispute arbitration agreements and joint-action waivers unenforceable for claims under this Act. Subsection (d) imposes heightened third-party disclosure requirements — each third party must be specifically named in a standalone disclosure that is affirmatively presented and acknowledged, separate from any privacy policy or terms of service.
(a) NO PREEMPTION OF EXISTING STATE LAWS.—Nothing in this Act shall be construed to preempt or limit any law, rule, regulation, or common law doctrine of any State that is in effect as of the date of enactment of this Act.
(b) MINIMUM STANDARD.—This Act shall be construed as establishing a minimum standard for the tort described in section 3(a), and nothing in this Act shall be deemed to prohibit or restrict the application of any State law, rule, regulation, or common law doctrine that provides greater or additional rights, remedies, or protections than the rights, remedies, and protections provided under this Act.
Section 4 is a savings clause that expressly disclaims any preemptive effect on existing state laws. The Act is framed as a minimum standard — any state law providing greater rights, remedies, or protections remains fully applicable. This is significant because it means compliance with this federal tort does not satisfy state-law data-consent obligations, and plaintiffs may pursue both federal and state claims simultaneously.