S. 2367 creates a federal civil lawsuit right for individuals whose personal data is collected, used, sold, or exploited without their clear, advance permission. The bill broadly defines "covered data" to include traditional personal information, browsing habits, location data, biometric information, and data generated by AI systems based on individuals' information. Companies and AI providers would be prohibited from using this data without "express, prior consent"—meaning individuals must clearly agree in advance to specific uses—and the bill establishes particular rules requiring companies to explicitly disclose any third parties who will receive the data. People who win these lawsuits can recover actual damages, triple any profits the company made from misusing their data (with a minimum of $1,000), punitive damages, and attorney fees. The legislation prevents companies from forcing disputes into private arbitration or blocking class-action lawsuits through fine-print agreements, instead reserving these claims for courts. The bill establishes a federal baseline but does not prevent states from enacting stronger data protection laws.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.