Introduction
The bipartisan AI Accountability and Personal Data Protection Act [2] [4], introduced by US Senators Josh Hawley and Richard Blumenthal, seeks to address the unauthorized use of copyrighted materials by AI companies. This legislation aims to protect creators’ rights and personal data by establishing new legal frameworks and obligations for AI companies.
Description
US Senators Josh Hawley and Richard Blumenthal have introduced the bipartisan AI Accountability and Personal Data Protection Act [2], which aims to address the exploitation of creators’ works by AI companies that have been using copyrighted materials without consent or compensation [4]. This legislation seeks to significantly alter the legal landscape for AI companies by undermining the fair use defense and responding to the widespread intellectual property theft identified by Senator Hawley, particularly the unauthorized scraping of millions of copyrighted books from pirate websites for training generative AI models [4]. These models produce synthetic works that compete with legitimate titles [4], undermining the market for original creators [4].
The proposed legislation establishes a federal cause of action that allows individuals [2], including authors, journalists [4], musicians [4], and visual artists [4], to sue companies utilizing personal data or copyrighted works for AI training without obtaining clear [2], affirmative consent [2]. This consent is defined as a specific [2], informed [2], and unambiguous agreement made in advance by the individual [2]. The Act reinforces the rights of authors over their creations and prohibits AI companies from utilizing copyrighted works without explicit permission, thereby protecting the livelihoods of creators whose rights and earnings are threatened by current AI practices. Additionally, a new federal tort is created for data misuse [3], allowing individuals to pursue legal action for unauthorized appropriation or exploitation of personal data and copyrighted works [3].
Notably, the Bill eliminates the requirement for copyright registration before initiating a copyright infringement lawsuit [1], diverging from current Copyright Act requirements [1] [2]. Individuals who prevail in lawsuits can recover various forms of damages [2], including compensatory and punitive damages [2], as well as attorney’s fees [2]. The legislation also establishes stringent financial penalties and injunctive relief [3], empowering individuals to pursue legal action [3], including class actions [1] [2] [3].
If a company intends to involve a third party in the use [2], collection [1], processing [1] [2], sale, or exploitation of covered data [3], it must explicitly disclose this information separately from general privacy policies or terms of service [2]. The legislation mandates transparency by requiring companies to disclose all third parties that will access an individual’s data at the time consent is obtained [3]. It specifies that browsewrap agreements are insufficient for such disclosures [2], and mere hyperlinks or general references to privacy policies do not suffice for obtaining the necessary consent [1].
Additionally, the legislation prohibits arbitration clauses or contracts that limit the right to sue [1] [2], ensuring that predispute arbitration agreements or joint-action waivers are not enforceable for claims arising under the Act [1]. Individuals retain the right to participate in class actions [1], regardless of any conflicting agreements [1].
While the Bill has garnered bipartisan support [2], reflecting a growing demand for enhanced regulation of AI and data practices [1] [2], its future in Congress remains uncertain [2]. Concurrently [2], the Transparency and Responsibility for Artificial Intelligence Networks Act has been reintroduced [1] [2], which aims to establish a process for individuals to compel AI developers to disclose their training data through an administrative subpoena process.
To ensure compliance [1], companies should conduct audits of their AI training datasets and data collection practices to verify the use of personal or copyrighted data with clear consent [1]. They should also revise privacy policies and consent mechanisms to enhance transparency and specificity while closely monitoring legislative developments [1], particularly in data-intensive or AI-driven sectors [1]. Proactive compliance measures can help mitigate potential legal and reputational risks [1], ensuring the integrity of creative works and the financial stability of creators in the evolving landscape of AI technology [4].
Conclusion
The AI Accountability and Personal Data Protection Act represents a significant shift in the legal framework governing AI companies, emphasizing the protection of creators’ rights and personal data. By establishing new legal avenues and obligations, the legislation aims to curb unauthorized use of copyrighted materials and enhance transparency in data practices. As the bill progresses through Congress, its implications for AI companies and creators will be closely monitored, potentially reshaping the landscape of AI technology and intellectual property rights.
References
[1] https://natlawreview.com/article/senators-introduce-legislation-curb-use-personal-data-and-copyrighted-works-gen-0
[2] https://www.jdsupra.com/legalnews/senators-introduce-legislation-to-curb-9163300/
[3] https://navavoices.org/2025/07/30/supporting-nava-supports-the-ai-accountability-and-personal-data-protection-act-2025/
[4] https://authorsguild.org/news/ag-welcomes-ai-accountability-and-personal-data-protection-act/
