Data privacy rights for individuals

Summary#

This bill creates a new federal civil cause of action (a private right to sue) for the unauthorized appropriation, use, collection, processing, sale, or other exploitation of an individual’s covered data. It defines a wide range of “covered data,” requires clear, affirmative consent before companies use that data, and makes predispute arbitration clauses unenforceable for claims under this law. The bill aims to give people stronger legal remedies when their personal data is used without clear consent and to limit hidden data uses by companies and AI systems.

Key changes:

• Creates a federal tort letting individuals sue anyone who uses their covered data without express, prior consent.
• Defines “covered data” broadly, including identifying information, device IDs, geolocation, biometrics, behavioral and inferred data, and copyrighted content created by an individual.
• Covers use for AI, including training generative AI systems and AI output that imitates or derives from an individual’s covered data.
• Remedies for victims include actual damages, treble profits or $1,000 (whichever is greater), punitive damages, injunctions, and attorney’s fees.
• Makes arbitration waivers unenforceable for claims under this Act and requires courts, not arbitrators, to decide applicability.
• Consent rules require clear, separate disclosure of any third parties and forbid burying consent in general terms or hyperlinks.

What it means for you#

• Individuals / Consumers

  • You may be able to sue if a company or other person uses your covered data without clear, prior consent.
  • Consent must be an affirmative act. Consent obtained by coercion, deception, or as a take-it-or-leave-it condition that goes beyond what is needed to provide a service is invalid.
  • If your copyrighted creative work is used by an AI or company without consent, that may be covered.

• Businesses and AI developers

  • Companies that collect, process, sell, or use personal or inferred data must obtain clear, prior consent for those uses or face lawsuits.
  • If you pass data to third parties, you must disclose each third party clearly and separately at the time you seek consent. A link in a privacy policy is not enough.
  • Predispute arbitration clauses and class-waiver clauses cannot be used to prevent court lawsuits under this law for covered claims.

• Third parties and data buyers

  • Receiving or using covered data without evidence of valid express, prior consent could expose you to liability or aid-and-abet claims.

• Courts

  • Federal and state courts may hear these cases. A federal court will decide questions about the Act’s applicability to arbitration agreements.

• Employers / Labor agreements

  • The Act does not apply to arbitration terms in collective bargaining agreements between employers and labor organizations, except it does not bar judicial enforcement of constitutional or statutory rights.

Expenses#

No publicly available information.

Possible financial and administrative effects (based on the bill’s provisions):

• This could increase litigation costs for businesses that use personal or inferred data, because the bill gives a private right to sue and allows statutory remedies including treble profits and attorney fees.
• Companies may face higher compliance costs to collect clear consent, to provide separate third-party disclosures, and to change contract terms (removing pre-dispute arbitration or class-waiver provisions for covered claims).
• Courts could see more cases related to data use and AI training; this may increase judicial workload.

Proponents' View#

• The bill appears intended to protect individuals’ control over their personal and creative data by requiring clear, affirmative consent before exploitation.
• Supporters may argue it closes a gap around AI training and output by explicitly including AI training and AI-generated content that derives from an individual’s data.
• The law could be seen as increasing transparency by forcing clear disclosure of third parties who will receive or use data.
• Making arbitration waivers unenforceable for these claims is likely intended to preserve individuals’ access to courts and collective actions.

Opponents' View#

• One concern is that the bill’s broad definition of “covered data” and inclusion of inferred or derived data may be vague in practice and could lead to uncertain legal outcomes.
• The remedies (treble profits, punitive damages, attorney fees) could encourage high-value litigation and create large financial exposure for businesses, including those using public or aggregated data.
• It is unclear how courts would measure “profits” from use of covered data or how to handle cases where data uses are bundled into larger products.
• The bill does not say whether government agencies can enforce the rule; it focuses on private lawsuits, leaving enforcement and oversight questions unclear.
• Requiring separate, affirmative disclosure for each third party could be complex to implement for companies that use many downstream partners or for services that change data-sharing arrangements frequently.