PROACTIV Artificial Intelligence Data Act of 2025
- Sponsor
- Sen. Cornyn, John [R-TX]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jul 22, 2025
Bottom line
The bill establishes a voluntary federal framework and liability protections to combat child pornography in AI training data, aiming to foster ethical AI development and protect children.
What it actually does
This bill mandates the National Institute of Standards and Technology (NIST) to develop a voluntary framework for artificial intelligence (AI) developers and data collectors to detect, remove, and report child pornography found in AI training datasets, specifically those created by automated crawlers or scraping tools. It also grants limited liability protection to entities that comply with this framework, shielding them from certain lawsuits related to these actions.
Proponents argue
Proponents argue that this legislation is a critical and proactive step to prevent the inadvertent spread of child pornography within rapidly evolving AI systems, thereby protecting children and ensuring responsible technological advancement. They emphasize that the voluntary nature of the framework, coupled with essential liability protections, will encourage broad industry adoption and effective self-regulation.
Opponents contend
Opponents might express concerns that a purely voluntary framework may not be sufficiently robust to ensure universal compliance, potentially allowing some problematic content to persist. Some may also question whether the proposed liability protections could be too broad, potentially limiting accountability for errors or negligence, or if the scope of 'covered datasets' is too narrow.
The bill is concise and clearly written, allowing for a thorough reading and understanding of its provisions within a short timeframe.
Section 1
Short Title
This section establishes the official short titles for the Act: the 'Preventing Recurring Online Abuse of Children Through Intentional Vetting of Artificial Intelligence Data Act of 2025' and the 'PROACTIV Artificial Intelligence Data Act of 2025.' These titles provide a concise and memorable way to refer to the legislation in public discourse and legal contexts.
Supporters argue
Supporters would argue that clear and concise short titles make the bill more accessible and easier to reference, particularly the acronym 'PROACTIV AI Data Act,' which effectively communicates its purpose.
Critics contend
No specific opposition is typically raised against short title provisions as they are standard legislative practice and do not alter substantive policy.
Section 2
Key Definitions for AI and Data Roles
This section defines critical terms used throughout the Act, including 'artificial intelligence,' 'artificial intelligence developer,' 'artificial intelligence deployer,' 'artificial intelligence user,' 'child pornography,' 'covered dataset,' and 'data collector.' These definitions clarify who the bill applies to and what specific data and content are targeted. Notably, 'covered dataset' is limited to data collected for AI training using automated crawlers or scraping tools.
Section 3(a)-(d)
NIST Framework for Detecting, Removing, and Reporting Child Pornography
This section mandates the Director of the National Institute of Standards and Technology (NIST) to develop and publish a *voluntary* framework within one year of enactment. This framework will provide guidelines, best practices, methodologies, procedures, and processes for artificial intelligence developers and data collectors to detect, remove, and regularly report child pornography found in covered datasets. NIST must collaborate with other federal agencies (like NSF, NCMEC, DOJ) and public/private sector organizations, and solicit stakeholder input. The framework explicitly *does not* apply to AI deployers or users.
Section 3(e)
National Science Foundation Research into Detection Methods
This provision directs the Director of the National Science Foundation (NSF) to support research into innovative approaches for detecting, removing, and reporting child pornography from covered datasets. This research includes work conducted through the Directorate for Technology, Innovation, and Partnerships, aiming to advance the technical capabilities in this critical area.
Section 4
Limited Liability Protection for Compliant Actions
This section grants limited liability protection to artificial intelligence developers and data collectors who detect, remove, or report child pornography in covered datasets *in accordance with the NIST framework*. Such actions cannot be the basis for a cause of action in court, and any such action must be promptly dismissed. This protection does not apply if the developer or collector engaged in intentional misconduct, acted with actual malice, reckless disregard, gross negligence, or violated existing child pornography laws (18 U.S.C. 2251).
Defines 'covered dataset' as a set of data collected for the purpose of training an artificial intelligence system, *specifically if it was created using automated data crawlers or data scraping tools*, whether or not directed by a human operator.
Section 2(6)
Why it matters:This is standard legislative practice to precisely define terms and limit the scope of the bill's applicability to a specific problem area, rather than imposing broad requirements on all data collection.
Case for: Proponents argue that this specific definition targets the most common methods by which vast, unfiltered datasets are compiled for AI training, which are prone to inadvertently including illicit content. It avoids burdening datasets collected through other, potentially more curated, means.
Case against: Critics might argue that limiting the scope to automated crawlers/scrapers could leave significant gaps, as child pornography might also be present in datasets collected or curated through other methods, potentially creating a loophole.
Estimated impact: This provision significantly narrows the applicability of the NIST framework and the associated liability protections to a specific subset of AI training data, impacting only those AI developers and data collectors who utilize these automated methods.
Explicitly states that the framework published under subsection (a) shall apply to persons who are artificial intelligence developers and data collectors, and *not* to persons who are solely artificial intelligence deployers or artificial intelligence users.
Section 3(c)
Why it matters:This is a deliberate policy choice to focus the framework on the initial stages of data collection and AI system development, where the illicit content is most likely to be introduced, rather than downstream use or deployment.
Case for: Supporters argue this focus is appropriate because the problem of child pornography in training data originates during collection and initial processing. Extending the framework to deployers and users would be overly broad and impractical, potentially stifling innovation at later stages.
Case against: Critics might argue that deployers and users also have a role in ensuring the ethical use of AI and that excluding them entirely might create a loophole if problematic data persists or is introduced later in the AI lifecycle, or if models generate such content.
Estimated impact: This provision significantly limits the scope of entities directly responsible for implementing the NIST framework, focusing compliance efforts on the upstream stages of AI development.
Specifies that the limited liability protection granted in subsection (a) does *not* apply to a cause of action if the artificial intelligence developer or data collector engaged in intentional misconduct, acted with actual malice, reckless disregard, gross negligence, or violated 18 U.S.C. 2251 (child pornography production/distribution).
Section 4(b)
Why it matters:This is standard legal drafting to ensure that protections for good-faith actors do not inadvertently shield malicious or grossly negligent behavior, maintaining a baseline of accountability.
Case for: Proponents argue these exceptions are crucial to prevent the liability shield from being abused, ensuring that bad actors remain accountable under existing law for egregious misconduct related to child pornography.
Case against: Some might argue that the legal thresholds for 'reckless disregard' or 'gross negligence' could still be difficult to prove, potentially leaving some victims without adequate recourse in cases of significant, but not intentional, harm.
Estimated impact: This provision maintains a degree of accountability for AI developers and data collectors, preventing the liability shield from being absolute and ensuring that severe misconduct remains actionable under existing legal frameworks.