A bill letting people sue over data used without consent — counting both training on it and generating content derived from it
S.2367, the AI Accountability and Personal Data Protection Act, establishes a federal tort relating to the appropriation, use, collection, processing, sale or other exploitation of individuals data without express, prior consent. Beyond training a generative AI system, it counts generating content that imitates, replicates or is substantially derived from an individual data.
Bill overview (primary data)
- Bill numberS. 2367
- TypeSenate Bill
- Congress119th Congress
- Latest actionRead twice and referred to the Committee on the Judiciary.（2025-07-21）
Key points
- S.2367 establishes a federal tort for appropriating, using, collecting, processing, selling or otherwise exploiting individuals data without express, prior consent.
- It takes the shape of a right for individuals to sue rather than oversight by an agency.
- Use covers both training a generative AI system and generating covered data pertaining to an individual.
- The generation branch reaches content that imitates, replicates or is substantially derived from the data.
- Introduced July 21, 2025 by Mr. Hawley with Mr. Blumenthal and referred to the Judiciary Committee; 94 of the 120 bills this site holds as of 2026-09-02 are at that stage.
1Creating a right to sue rather than a regulation
Legislation on data use comes in two shapes: giving an agency oversight, or giving individuals a right to sue. This bill is the second, establishing a federal tort. It does not depend on an agency enforcement capacity or budget, since the party affected can go to court directly. In exchange, whether to sue rests on the individual judgment and burden.
2What counts as use
The core of this bill is including the right-hand column within use. Asking only whether data was used in training runs into the difficulty that training is hard to observe from outside and hard to prove. Capturing the output side — that content imitating, replicating or substantially derived from a person data was generated — lets the affected party start from something they can see.
3The phrase substantially derived
That the text writes imitates, replicates or is substantially derived in three steps signals that something short of an exact copy can fall within scope. It reads as reaching reproduction in a form that is recognizable without being a copy — a voice, a writing style, a manner. Where the line falls will be contested in application, but the intent is set out at the level of the text.
4Sponsors and stage
The sponsors are Mr. Hawley and Mr. Blumenthal, two members of different parties. Introduced July 21, 2025, it was read twice and referred to the Committee on the Judiciary. Of the 120 bills this site holds as of 2026-09-02, 94 (78 percent) remain referred to committee, and this bill is at that stage. At the same date, 70 originate in the House and 50 in the Senate.
Why it matters
A legislative pattern that frames the training-data question as an individual right of action rather than administrative regulation. Reaching content that is substantially derived, not only copied, bears directly on how output controls are designed.
FAQ
What does establishing a tort mean?
Why cover the generation side?
Sources (primary)
Source: Congress.gov (Library of Congress; U.S. legislative materials, public domain). Links go to the official site.
- Congress.gov (bill page, original)
- S. 2367（119th Congress）