On March 19, 2024, US Senator Ben Ray Luján announced the introduction of a bill to require companies to receive consent from consumers having their data used to train an artificial intelligence system to the U.S. House of Representatives.

In particular, the bill highlights a prohibition on covered entities from using, selling, or transferring to a third party any covered data of an individual that is collected to train an artificial intelligence (AI) system. Covered entities are permitted to use the covered data of an individual to train an AI system or sell or transfer such data for training an AI system if the covered entity:

• provides the individual with a clear and conspicuous disclosure of how the covered entity or third party will use the data; and
• obtains the express informed consent of the individual to use the data for training AI.

Regarding consent, the bill outlines that regulations will require:

• that individuals may grant or revoke consent at any time through an accessible and easily navigable mechanism;
• the option to withhold or revoke consent must be as prominent as the option to accept and must take the same number of steps or fewer;
• consent must be obtained independently of the terms of service;
• consent cannot be inferred from an individual's action or inaction, such as hovering over or closing a window or piece of content;
• services must not be reduced, restricted, or made conditional on whether an individual withholds consent; and
• should consent be revoked, all data used to train AI systems must be deleted.

Notably, the bill stipulates that a violation of its provisions will be considered an unfair or deceptive act or practice pursuant to the Federal Trade Commission Act (FTC Act). The Federal Trade Commission is also responsible under the bill for enforcing regulations issued under the bill, which outline, among other things:

• a standard for what constitutes clear and conspicuous disclosure, taking into account different platform types, and the brevity, accessibility, and clarity of disclosures;
• the possibility of consumer fatigue to disclosures; and
• that disclosures outline how data is used to train AI systems.

Finally, the bill also clarifies that it does not pre-empt any State law that provides greater protection to users of services provided by covered entities.

You can read the press release here and the bill here.