S. 2367 — AI Accountability and Personal Data Protection Act

This section defines nine terms for purposes of the Act: (1) "appropriate, use, collect, process, sell, or otherwise exploit" (including training generative AI systems and generating covered data pertaining to individuals); (2) "artificial intelligence" (as defined in 15 U.S.C. 9401); (3) "artificial intelligence system"; (4) "covered data" (information identifying or relating to an individual, derived or inferred data, or individually generated copyrighted material); (5) "express, prior consent"; (6) "generative artificial intelligence system" (capable of generating novel text, video, images, audio, or other media); (7) "personally identifiable information"; (8) "predispute arbitration agreement"; and (9) "predispute joint-action waiver."

This section establishes a federal tort liability for any person who, in or affecting interstate or foreign commerce, appropriates, uses, collects, processes, sells, or otherwise exploits an individual's covered data without the individual's express prior consent. It creates a private right of action allowing affected individuals to sue violators or aiders/abettors in federal district court or state court of competent jurisdiction, with remedies including (1) compensatory damages equal to the greater of actual damages, treble profits, or $1,000; (2) punitive damages; (3) injunctive relief; and (4) attorney's fees and costs. Consent serves as an affirmative defense but is invalid if obtained through coercion or deception or as a condition of using a product or service where data exploitation exceeds what is reasonably necessary. This section declares predispute arbitration agreements and joint-action waivers unenforceable for claims under the Act (notwithstanding the Federal Arbitration Act), voids agreements waiving court access or class/collective actions as contrary to public policy, and requires federal courts (not arbitrators) to determine the Act's applicability under federal law. Collective bargaining agreements are exempt except to preserve workers' rights to judicial enforcement of constitutional, statutory, or public policy protections. Consent for third-party data exploitation is invalid unless each third party is specifically and clearly disclosed at the time consent is sought, presented distinctly and separately from privacy policies or terms of service (not via hyperlink or general reference), and affirmatively acknowledged by the individual.

This section provides that the Act does not preempt or limit any state law, rule, regulation, or common law doctrine in effect on the date of enactment and establishes a minimum standard for the tort described in section 3(a). (Thus, states may enact laws providing greater rights, remedies, or protections than those under this Act.)