This bill, titled the AI Accountability and Personal Data Protection Act, establishes a new federal tort to protect individuals' data privacy. It makes any person liable for appropriating, using, collecting, processing, selling, or otherwise exploiting an individual's "covered data" without their express, prior consent. This broad definition of data exploitation explicitly includes the training of generative artificial intelligence systems and the generation of content by such systems that imitates or is derived from an individual's data. Covered data encompasses personally identifiable information, unique identifiers, geolocation, biometric, behavioral, and inferred data, as well as copyrighted material generated by an individual.

The Act grants individuals a private right of action, allowing them to bring civil lawsuits and seek substantial remedies, including compensatory damages (actual damages, treble profits, or a minimum of $1,000), punitive damages, and injunctive relief. While consent is an affirmative defense, it must be freely given, informed, and unambiguous, not obtained through coercion or as an overly broad condition of service. Importantly, predispute arbitration agreements and joint-action waivers are rendered invalid and unenforceable for claims under this Act.

For consent to be valid when data is shared with or exploited by third parties, each third party must be specifically and clearly disclosed to the individual. This disclosure must be affirmatively presented, distinct from general privacy policies, and cannot be satisfied by mere hyperlinks. The bill clarifies that it does not preempt existing state laws, instead establishing a minimum standard for data protection and allowing states to provide greater rights or remedies.