Congress gives you the right to sue over your data—and bans forced arbitration
S. 2367 — AI Accountability and Personal Data Protection Act · Filed by Josh Hawley (R-MO) · 2 cosponsors · Introduced Jul 21, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill creates a federal law allowing individuals to sue companies that collect, use, or sell their personal data—including training AI systems—without explicit permission first. It requires companies to get clear, upfront consent before using anyone's data, bans forced arbitration and class-action waivers for these disputes, and lets people recover damages of at least $1,000 per violation, treble profits, or actual damages, plus attorney fees.
Why we flagged it
The bill's core function is to establish a private right of action for data misuse and ban arbitration waivers—a consumer protection mechanism that shifts enforcement from regulators to individuals. It is fundamentally about accountability and individual remedy, not industry subsidy or carve-out.
What the text implies
- Treble-damages provision may incentivize high-volume litigation against data brokers and AI companies, potentially creating a new litigation industry and raising compliance costs across tech sector.
- Ban on predispute arbitration and class-action waivers eliminates a major cost-containment tool for companies, likely increasing settlement exposure and insurance costs.
The full analysis lists 5 implications of this text.
Who stands to gain
plaintiff's attorneys (class action and individual litigation); data privacy consultants and compliance firms; cyber insurance providers