AI Accountability and Personal Data Protection Act

This bill would give people a clear right to sue if a company or person takes, uses, sells, or otherwise exploits their personal data without their express, prior consent. “Personal data” includes information that can identify you. Consent must be a clear “yes,” given in advance, and it can’t be tricked or forced. You can’t be made to agree to data use that goes beyond what’s reasonably needed for the product or service. If data will be shared with third parties, each one must be clearly named in a separate, easy‑to‑see disclosure, not buried in a privacy policy link. If you win in court, you could get the greater of your actual damages, three times the wrongdoer’s profits, or $1,000, plus possible punitive damages, a court order to stop the behavior, and attorney’s fees. Companies can’t force these claims into arbitration or block class actions with fine print. Stronger state privacy rules would still apply; this sets a national floor, not a ceiling ( ).

Key points:

• Express, prior consent is required before using or sharing your data, and consent gained by deception, coercion, or as a condition that exceeds what’s necessary is invalid ().
• Each third party that may get your data must be named in a stand‑alone disclosure you can’t miss; a generic privacy policy link isn’t enough ().
• You can sue in state or federal court; arbitration and class‑action waivers don’t apply to these claims ().
• Minimum national standard; stronger state protections remain in place ().
• Definitions cover AI and generative AI systems that use or create content from data, tying the rules to modern tech ().