New federal law lets you sue companies for AI data misuse—no arbitration escape.
S. 2367 — AI Accountability and Personal Data Protection Act · Filed by Josh Hawley (R-MO) · 2 cosponsors · Introduced Jul 21, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill creates a federal civil lawsuit right for individuals whose personal data is used by AI systems or companies without their explicit, advance permission. Anyone whose data is appropriated, processed, sold, or used to train AI without consent can sue for damages (actual damages, triple profits, or $1,000 minimum), punitive damages, and attorney fees. The bill blocks companies from forcing arbitration or class-action waivers to escape liability.
Why we flagged it
The bill's core mechanism is a federal tort creating private enforcement of data consent and use restrictions, with specific focus on AI systems. It is fundamentally a consumer protection and accountability measure, not a regulatory expansion of agency authority.
What the text implies
- The definition of 'covered data' includes data 'generated by an individual and protected by copyright,' which may extend liability to AI systems trained on copyrighted creative works (art, music, writing) without explicit consent—a significant expansion of copyright enforcement through tort.
- The 'treble profits' remedy (triple the defendant's gains) creates incentive for mass litigation and may drive settlement behavior independent of actual harm, potentially inflating litigation costs for data-handling businesses.
- The bill does not exempt government agencies or law enforcement from the consent requirement, potentially restricting federal data collection and surveillance programs, though the scope depends on how 'express, prior consent' is interpreted in national security contexts.
- The requirement that third-party disclosures be 'affirmatively presented' and 'seen and acknowledged' may be difficult to enforce in practice and could lead to disputes over what constitutes valid acknowledgment (click, scroll, signature, etc.).
- State law preemption is explicitly rejected, meaning states can impose stricter standards—creating a patchwork of data-consent regimes and potential conflicts for national platforms.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Ordinary people gain a direct legal remedy against data exploitation by AI companies and other entities, with statutory damages ensuring even small harms are actionable, and the bill explicitly preserves class actions and court access. The consent requirement and third-party disclosure rules create enforceable privacy protections that did not exist before.
Who stands to gain
- plaintiff's attorneys (contingency-fee litigation)
- class-action law firms
Named in the bill
generative AI systems / providers, data brokers, technology companies, Federal Arbitration Act, National Artificial Intelligence Initiative Act of 2020, U.S. District Courts, State courts
Where it stands
2 cosponsors: 2 Democrats.
- Jul 21, 2025 — Introduced · Congress.gov: “Introduced in Senate”
- Jul 21, 2025 — Referred to Senate Committee on the Judiciary · Congress.gov: “Read twice and referred to the Committee on the Judiciary”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
Money around this bill
6 lobbying clients named this bill on 8 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $3,410,758 in lobbying spend. A filing names 24 bills on average, so that figure is what each filing reported, not a share belonging to this bill.
More lobbying clients named this bill than 82% of bills with at least one filing.
Josh Hawley, the sponsor, reported $68,000 in PAC receipts in the 2026 cycle.
- Entertainment Software Association — $1,390,000 on 1 filing
- National Association of Mutual Insurance Companies — $1,005,758 on 2 filings
- News Media Alliance — $475,000 on 1 filing
- Sony Music Entertainment (formerly Known As Sony Bmg Music Entertainment) — $410,000 on 1 filing
- Bria Artificial Intelligence Inc. — $80,000 on 2 filings
Lobbying Disclosure Act filings through Jul 21, 2026. A filing shows who paid to lobby on a bill it names, not what changed.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (9,798 characters) on May 21, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
Money — Senate Lobbying Disclosure Act filings whose specific-issue field names this bill for quarters ending Dec 2025 to Jun 2026. A filing's amount is reported whole beside the median number of bills a filing names; it is never divided across them. PAC receipts are FEC-reported contributions to the sponsor's candidate committee in the 2026 cycle.
As of — lobbying records through Jul 21, 2026 · page rendered 2026-10-20.
“New federal law lets you sue companies for AI data misuse—no arbitration escape.” QuorumCivic. https://share.quorumcivic.app/bill/119/s2367 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.