The bill introduced by U.S. Senators Josh Hawley and Richard Blumenthal, titled the AI Accountability and Personal Data Protection Act, represents a major legislative initiative aimed at establishing federal civil liability for the unauthorized use of personal data, particularly in the context of generative artificial intelligence.
This ambitious proposal is part of a global trend towards strengthening individual protections against the mass commercial and technological exploitation of personal data and reflects a significant shift in U.S. law towards a more rights-centered approach.
The bill seeks to establish a federal civil cause of action against any appropriation, use, collection, processing, sale, or other exploitation of an individual’s personal data without their express prior consent. This liability would apply to activities affecting interstate or foreign commerce, thereby giving the bill particularly broad reach in the context of a globalized digital market.
The legislation specifically targets so-called “generative AI systems,” which are capable of producing text, images, videos, or audio based on user inputs. By focusing on this category of AI, lawmakers are responding to growing concerns about the training of machine learning models on vast datasets that are often collected without the knowledge or consent of the individuals concerned.
The bill provides a set of definitions that frame its scope and demonstrate the lawmakers’ intent to comprehensively address the issue of personal data in the digital ecosystem. The term covered data is defined to include all information that identifies, or is reasonably capable of identifying, an individual, whether directly or indirectly. This includes personally identifiable information, biometric data, browsing history, geolocation data, behavioral data, and even copyrighted content, such as artistic and intellectual works, which may be integrated into AI training datasets.
The bill also defines generative AI systems as any artificial intelligence system capable of creating original content from user-provided input. This definition is intended to encompass all emerging technologies that could exploit personal data for the purpose of automated content generation.
Finally, the consent required under the bill is characterized as “express and prior,” meaning a clear, affirmative, and unambiguous manifestation of the individual’s will. The proposal expressly excludes any form of implied consent or consent obtained by default, imposing a higher standard of transparency and granularity in the management of authorizations.
The bill enshrines a principle of civil liability applicable to any natural or legal person that exploits covered data without obtaining the requisite consent. This liability also extends to situations where an entity aids or facilitates such exploitation, or benefits indirectly from it, for instance by providing tools or services enabling the unauthorized use of data.
Individuals whose rights are infringed would have a direct right of action before federal or state courts. The remedies available under the bill are significant and designed to deter violations. They include compensatory damages, calculated either based on actual losses suffered or, at the plaintiff’s election, as treble the profits wrongfully obtained, with a minimum statutory award of $1,000. Punitive damages may also be awarded depending on the severity of the violation. In addition, courts would be empowered to grant injunctive relief to halt unlawful practices and order the reimbursement of attorneys’ fees and litigation costs incurred by the plaintiff.
The bill further renders void and unenforceable any contractual clauses imposing pre-dispute arbitration agreements or restricting the right to bring joint or class actions (pre-dispute joint-action waivers). This approach, which is relatively rare in the U.S. legal context, reflects a strong legislative intent to preserve effective access to the courts for individuals seeking redress.
The proposal explicitly states that it does not preempt state laws. States retain the ability to adopt or maintain provisions offering greater protection of personal data. In this way, the bill establishes a federal minimum standard while allowing states to go beyond its requirements. This balance respects the principle of federalism while ensuring a baseline level of protection nationwide.
This bill represents a notable evolution in U.S. law towards stronger protection of personal data, particularly in the field of artificial intelligence. It shares several points of convergence with the European Union’s General Data Protection Regulation (GDPR), such as the primacy of explicit consent, the requirement for transparent information, and the possibility of collective actions.
For companies operating in the AI sector, adoption of the bill would necessitate a profound reassessment of data collection and exploitation practices. Organizations would be required to implement stricter consent management mechanisms and exercise heightened diligence regarding litigation risks, given the availability of private rights of action and the exclusion of arbitration clauses.
For individuals and rights holders, the bill offers a substantial advancement by enabling them to regain control over the use of their data and creative works, while providing strengthened judicial tools to enforce their rights.
The AI Accountability and Personal Data Protection Act could, if enacted, become a landmark in U.S. regulation of artificial intelligence and personal data protection. By imposing strict obligations on AI system operators and strengthening individual rights, it would contribute to redefining the balance between technological innovation and the protection of fundamental rights. This legislative initiative, which reflects a global trend towards more stringent regulation, may also inspire other jurisdictions facing similar challenges.
This article was prepared by a French attorney. For any legal opinion regarding U.S. law, consultation with an attorney licensed to practice in the United States is recommended.
