AI Accountability and Personal Data Protection Act
- Sponsor
- Sen. Hawley, Josh [R-MO]
- Committees
- Judiciary Committee (primary)
- Last action
- Jul 21, 2025
Bottom line
This bill seeks to grant individuals broad control over their personal data, particularly in the context of artificial intelligence, by establishing a new federal right to sue for unauthorized data exploitation.
What it actually does
This bill establishes a new federal tort, allowing individuals to sue any person who appropriates, uses, collects, processes, sells, or otherwise exploits their 'covered data' without their express, prior consent. It explicitly includes the training of generative artificial intelligence systems and the generation of AI content derived from an individual's data within the scope of prohibited exploitation. The bill also invalidates predispute arbitration agreements and joint-action waivers for claims arising under this new tort.
Proponents argue
Supporters argue this legislation is crucial for empowering individuals, protecting privacy in the age of AI, and ensuring accountability for technology companies that profit from personal data without explicit permission. They contend it directly addresses concerns about the unauthorized use of data for AI training and the generation of AI content derived from personal data, providing necessary legal recourse.
Opponents contend
Opponents might argue that the bill's broad definitions of 'covered data' and 'exploitation,' coupled with stringent consent requirements and robust remedies, could stifle innovation in AI development, create a flood of litigation, and impose overly burdensome compliance requirements on data processing, potentially hindering legitimate business operations and research.
The bill is concise and clearly structured, making it accessible for an informed reader to understand its core provisions and implications within a short timeframe.
Section 3(a)
Federal Tort for Unauthorized Data Exploitation
This provision creates a new federal legal claim, or 'tort,' allowing individuals to sue anyone who 'appropriates, uses, collects, processes, sells, or otherwise exploits' their 'covered data' in interstate or foreign commerce without their explicit, advance permission. This means companies cannot use personal data, including for AI systems, without clear consent.
Supporters argue
Supporters contend this provision is essential for protecting individual privacy in the digital age, particularly as AI systems increasingly rely on vast datasets. It gives individuals agency over their digital footprint and holds companies accountable for unauthorized data use.
Critics contend
Critics may argue that this broad liability could hinder innovation, particularly in AI development, by making data acquisition and processing excessively complex and risky. They might also suggest it could lead to a surge in litigation.
Tradeoffs
This provision balances individual privacy rights and corporate innovation. Stricter data protection may come at the cost of data-driven development, while looser protections risk widespread data exploitation.
Section 3(b)
Individual Legal Recourse and Damages
This section grants individuals the right to file a civil lawsuit in federal or state court against anyone who exploits their data without consent, or aids in such exploitation. Successful plaintiffs can recover actual damages, triple any profits made from the data misuse, or a minimum of $1,000, along with punitive damages, injunctive relief, and attorney's fees.
Section 3(c)
Prohibition on Forced Arbitration for Data Misuse Claims
This provision explicitly states that any agreement made before a dispute arises (predispute arbitration agreement) or any waiver of the right to participate in a class action (predispute joint-action waiver) is invalid and unenforceable for claims brought under this Act. It ensures that individuals can pursue their claims in court, including through class actions, rather than being forced into private arbitration.
Section 3(d)
Enhanced Third-Party Data Sharing Consent Requirements
This section mandates that for consent to be valid when data is shared with or used by a third party, each specific third party must be clearly disclosed to the individual at the time consent is requested. This disclosure must be presented distinctly and separately from general privacy policies or terms of service, and cannot be satisfied by mere hyperlinks or general references.
Section 2(4)
Broad Definition of Protected Personal Data ('Covered Data')
'Covered data' is broadly defined to include any information that identifies, relates to, describes, or can be linked to an individual, or is derived from such information. It explicitly includes personally identifiable information, unique identifiers (like IP addresses), geolocation, biometric, and behavioral data, as well as inferred data used to profile individuals. Crucially, it also includes content generated by an individual and protected by copyright, regardless of registration.
Section 2(1)
Explicit Inclusion of AI Training and Generation in Data Exploitation
This definition explicitly states that 'appropriating, using, collecting, processing, selling, or otherwise exploiting' covered data includes using it to train a generative artificial intelligence system that is sold, rented, licensed, or used by its provider. It also includes the generation of covered data by an AI system that imitates or is substantially derived from an individual's covered data.
Specifies that consent is not valid if obtained through coercion, deception, or as a condition of using a product or service where data exploitation exceeds what is 'reasonably necessary' to provide that product or service.
Section 3(b)(3)(B)
Why it matters:While it is standard legislative practice to define exceptions and conditions within relevant sections, this sub-clause significantly impacts the practical validity of consent, making it a critical detail that could be missed by a casual reader.
Case for: Supporters argue this provision is essential to prevent companies from using 'dark patterns' or bundling consent for unrelated data uses, thereby ensuring that consent is truly 'freely given, informed, and unambiguous' as defined in the bill.
Case against: Critics might argue that the term 'reasonably necessary' is subjective and could lead to legal uncertainty, making it difficult for companies to design products and services without fear of litigation over what constitutes excessive data exploitation.
Estimated impact: This provision significantly alters how companies must obtain consent, making broad 'take-it-or-leave-it' terms of service less viable and requiring more granular and transparent consent mechanisms.