Explainer: The unfinished phrase in the headline refers to copyrightable works used in artificial intelligence training data and generated outputs. The proposal at issue is the AI Accountability and Personal Data Protection Act, or S. 2367.

For years, artificial intelligence companies and creators have argued over a deceptively simple question: Can an AI developer train a commercial model on someone’s books, photographs, songs, articles, software, or personal data without first asking permission?

The proposed AI Accountability and Personal Data Protection Act offers an unusually direct answer: generally, no. Introduced by Senators Josh Hawley of Missouri and Richard Blumenthal of Connecticut on July 21, 2025, the bipartisan bill would establish a federal civil cause of action for exploiting covered data without an individual’s express, prior consent.

That legal construction matters. Rather than waiting for every dispute to squeeze itself into traditional copyright infringement, privacy, publicity-right, or contract claims, the bill would create a separate federal tort. In plain English, it would give individuals a new reason to sueand potentially a much larger legal hammer with which to do it.

What Is the AI Accountability and Personal Data Protection Act?

S. 2367 was introduced during the 119th Congress and referred to the Senate Judiciary Committee. Senator Peter Welch of Vermont later joined as a cosponsor. As of late June 2026, the measure remained pending and had not become federal law.

The bill’s public messaging focuses heavily on generative AI companies, but its operative language is broader. It applies to any person acting in or affecting interstate or foreign commerce who appropriates, uses, collects, processes, sells, or otherwise exploits an individual’s covered data without valid advance consent.

The proposal specifically says that exploitation includes:

• Training a generative artificial intelligence system that is sold, rented, licensed, or otherwise used by its provider.
• Generating covered data that pertains to an individual, including content that imitates, replicates, or is substantially derived from that person’s covered data.

That second provision may be just as consequential as the training rule. The bill is not concerned only with what goes into an AI model. It also reaches certain material that comes out of one.

Why the Definition of “Covered Data” Is So Important

The proposal defines covered data broadly enough to make the average privacy policy look like a postcard. It includes information, data, or material in any format that identifies, describes, relates to, or can reasonably be linked to a particular individual.

Covered data may also include information inferred or generated from identifiable data. Examples listed in the legislation include device identifiers, advertising IDs, IP addresses, geolocation information, biometric data, browsing histories, purchasing patterns, and predicted information used to build profiles about people or groups.

Copyrightable works are expressly included

The headline-making provision covers material generated by an individual and protected by copyright, regardless of whether the copyright has been registered with the U.S. Copyright Office or another registration authority.

That language potentially encompasses novels, blog posts, illustrations, photographs, musical compositions, recordings, videos, computer code, and other original expression fixed in a tangible medium. Copyright normally arises automatically when qualifying expression is created and fixed, although registration provides important procedural and remedial advantages under existing copyright law.

Under the proposed tort, lack of registration would not automatically exclude a qualifying work. A plaintiff would still need to establish that the material is protected, belongs to the individual, and was used without valid consent, but the proposal appears designed to avoid making registration the entrance ticket to the courthouse.

The Bill Would Replace Passive Permission With Real Consent

Most internet users have technically “agreed” to enough legal terms to wallpaper a small airport. The bill would make that familiar click-and-forget ritual far less useful to companies seeking permission to exploit covered data.

Express, prior consent would require a clear affirmative act made before the use occurs. Consent must be freely given, informed, unambiguous, and directed toward the specific collection, processing, sale, training, or other exploitation involved.

Consent could not simply hide in the terms of service

For disclosures involving third parties, the proposal requires each third party to be specifically identified when consent is requested. The disclosure must be presented separately from general terms, privacy policies, or user agreements. A hyperlink buried somewhere between the cookie settings and the sentence granting the platform dominion over the known universe would not be enough.

Consent obtained through deception or coercion would be invalid. It could also be invalid when access to a product or service is conditioned on allowing data exploitation that exceeds what is reasonably necessary to provide that product or service.

For AI developers, this would encourage a shift from “scrape first, litigate later” toward traceable licenses, documented permissions, and carefully limited data uses.

What Civil Liability Would Look Like

The proposed law would allow an affected individual to sue in federal district court or a state court with appropriate jurisdiction. Claims could be brought against the party that directly exploited the data and against a person who aided and abetted the conduct.

That aiding-and-abetting language could extend the compliance conversation beyond major model developers. Dataset vendors, scraping contractors, model-hosting businesses, application providers, data brokers, and commercial partners could all need to examine their roles more closely.

The availability of attorney’s fees is particularly important. Individual creators frequently lack the resources to pursue technology companies with enormous legal budgets. Fee shifting can make smaller claims financially realistic, while treble profits and punitive damages increase the stakes for defendants.

Class-action waivers would not provide an easy escape hatch

The legislation would make predispute arbitration agreements and predispute joint-action waivers unenforceable for claims arising under the act. Agreements attempting to prevent an individual from joining a class, collective, joint, or representative action would also be treated as invalid.

That provision is not decorative legal parsley. It could allow thousands of writers, artists, performers, photographers, or consumers with similar allegations to combine their claims rather than fighting one expensive case at a time.

How the Proposal Could Change the AI Copyright Debate

Existing lawsuits against AI companies have largely centered on the Copyright Act and its fair-use doctrine. Courts examine the purpose of the copying, the nature of the original work, how much was taken, and the effect on existing or potential markets.

The U.S. Copyright Office’s report on generative AI training concluded that several stages of model development may implicate copyright owners’ exclusive rights. It also emphasized that fair use is fact-specific. Some training uses may be transformative, while others may weigh against fair use because of commercial substitution, pirated source material, protected output, or harm to licensing markets.

Federal judges have already reached nuanced conclusions. Decisions involving Anthropic and Meta found certain model-training uses highly transformative under the facts presented, while separately raising concerns about pirated libraries, acquisition methods, market evidence, or the plaintiffs’ failure to prove particular harms.

S. 2367 would add a different question: Was express permission obtained?

Because the proposed tort contains no explicit fair-use exception, legal analysts have warned that it could make a successful copyright fair-use defense far less useful when the same conduct qualifies as unauthorized exploitation of covered data. A company might prevail on a traditional infringement theory yet still confront liability under the new consent-based cause of action.

Courts would eventually need to reconcile the proposal with existing copyright doctrines, registration rules, ownership principles, and defenses. The statutory text could also be amended substantially before passage. Anyone treating the introduced version as settled law is getting ahead of Congress by several exits.

Who Supports the Bill?

Creator organizations have responded favorably. The Authors Guild argued that the proposal would give writers and consumers meaningful tools to challenge unauthorized uses of their work and data. The National Association of Voice Actors highlighted its strong remedies, court access, and protection for collective claims.

Those endorsements reflect a common complaint among creators: copyright may exist automatically, but enforcing it against a global technology company is neither automatic nor inexpensive. Identifying which model used which work can be difficult, and establishing direct market losses may be even harder.

A consent-based rule could simplify the core issue. Instead of beginning with an elaborate debate about intermediate copying and transformative purpose, a court could begin by asking whether the defendant received permission for the particular use.

Major Questions and Possible Criticisms

Can consent work at the scale of modern AI?

Foundation models may be trained on billions or trillions of data points. Obtaining individual permission for every potentially protected item could be technically and economically difficult, particularly when ownership records are missing, disputed, or outdated.

Supporters would respond that inconvenience is not a license to take creative work for free. Critics may argue that a strict permission requirement could entrench the largest companies because they are best able to negotiate massive licensing agreements. The neighborhood AI startup, meanwhile, may need a lawyer before it needs a programmer.

Where are the research and public-interest exceptions?

The introduced text does not provide an express exception for academic research, nonprofit experimentation, education, security testing, search, accessibility, or open-source development. Amendments could add carefully defined exclusions, but the current language leaves substantial uncertainty.

Does the proposal cover past training?

The text does not clearly state that it applies retroactively. That omission raises practical questions about models trained before enactment, continued deployment of existing models, later fine-tuning, retrieval systems, and outputs generated after the law takes effect.

What about corporate ownership?

The bill focuses on covered data belonging to an individual. Many creative works are produced by individuals but later assigned to publishers, studios, employers, labels, or other companies. Courts or lawmakers may need to clarify who may sue when the creator, copyright owner, exclusive licensee, and data subject are not the same party.

How Businesses Can Prepare Without Waiting for Passage

Even if S. 2367 never advances in its current form, it provides a useful preview of where AI governance is heading. Permission, provenance, transparency, and contractual accountability are moving from optional talking points to operational requirements.

Organizations building or deploying AI should consider several practical measures:

• Create an inventory of training, fine-tuning, retrieval, and evaluation datasets.
• Document where each dataset came from and which rights accompany it.
• Separate public availability from legal permission; they are not synonyms.
• Preserve consent records in a form that can be audited later.
• Identify vendors, brokers, cloud providers, and subcontractors that touch covered data.
• Review contracts for warranties, indemnities, audit rights, and deletion obligations.
• Test outputs for memorization, replication, personal information, and protected expression.
• Establish a process for creators and consumers to submit objections or removal requests.

These practices can reduce risks under copyright, privacy, contract, consumer-protection, biometric-data, and publicity-right laws even without a new federal tort.

Implementation Experiences: What the Bill Could Look Like in Practice

Experience one: The independent photographer

Imagine an independent photographer who has spent 15 years building a distinctive archive of city images. She discovers that an AI image generator can reproduce several unusual compositions after users enter prompts naming her portfolio. Today, she may face an exhausting preliminary investigation: Did the company possess her files? Were they copied during training? Are the outputs substantially similar, or do they merely share unprotected ideas and style?

Under the proposed bill, her first question could be simpler: Did she give express, advance consent for the company to exploit her protected images? If not, she might assert the new federal tort even when a conventional copyright claim remains factually complicated. The possibility of injunctive relief and attorney’s fees could make counsel more willing to evaluate the case.

Experience two: The AI startup buying a “clean” dataset

Now consider a small software company developing a writing assistant for teachers. It purchases a dataset advertised as fully licensed. Six months later, authors allege that the vendor collected thousands of essays and books without permission.

The startup may insist that it acted in good faith, but the aiding-and-abetting provision would make supply-chain diligence extremely important. Its experience would resemble a food company discovering that a supplier’s “organic” label was printed with optimism rather than evidence.

Before training begins, the startup would likely demand source manifests, license records, creator-consent documentation, audit rights, and financial indemnification. A vague promise that the dataset was gathered from “publicly accessible sources” would no longer inspire confidence. So is a park bench, but that does not mean you can take it home.

Experience three: The platform redesigning consent

A social platform wishing to use member posts, photographs, audio clips, and direct interactions for AI development would need to redesign its permission process. Consent could not merely appear on page 63 of an updated user agreement beside language about governing law and acceptable emoji use.

The platform might present a separate choice explaining which model provider will receive the material, whether the content will be used for training or output generation, and whether declining will affect the basic service. Product managers, privacy lawyers, engineers, and designers would need to collaborate before launch rather than meeting for the first time during discovery.

Experience four: The enterprise customer deploying a third-party model

A retailer may believe the controversy belongs to the company that trained the model. However, the retailer could fine-tune that model using customer-support transcripts, purchase histories, employee documents, or marketing photographs. It might also use generated content that replicates a person’s protected work or identifiable characteristics.

The compliance experience would therefore extend beyond model developers. Enterprise customers would need data-minimization rules, consent controls, access restrictions, output monitoring, and a clear division of responsibility with vendors. “The AI did it” is unlikely to become a respected legal defense, no matter how confidently it is delivered.

Across these scenarios, the central lesson is the same: data provenance would become a product requirement. Companies would need to know not only what information they possess, but who created it, who owns it, what permission was granted, which third parties received it, and whether the resulting output remains within those boundaries.

What Happens Next?

Before becoming law, S. 2367 would need to move through committee, secure passage in the Senate and House, and receive presidential approval. Its definitions, defenses, remedies, and effective date could change considerably during that process.

Lawmakers may consider research exceptions, licensing systems, safe harbors, model-size thresholds, protections for good-faith downstream users, and clearer rules for previously trained systems. They may also debate whether the bill is primarily a privacy measure, a copyright measure, an AI accountability law, or an ambitious legal casserole containing all three.

Conclusion

The AI Accountability and Personal Data Protection Act represents a significant attempt to move control over creative work and personal data back toward individuals. Its central principle is straightforward: companies should obtain meaningful permission before using a person’s data or copyrightable expression to train commercial AI systems or generate derived content.

The proposal’s private right of action, treble-profit remedy, punitive damages, attorney’s fees, injunctions, and rejection of forced arbitration could produce substantial litigation risk. At the same time, its broad definitions and limited exceptions could create difficult questions for research institutions, startups, open-source developers, platforms, publishers, and companies that use third-party AI.

Whether S. 2367 becomes law in its current form is uncertain. The broader direction is much clearer: businesses will increasingly be expected to prove where their AI data came from, what rights they received, and whether the people behind that data genuinely agreed to its use.

Note: This article discusses proposed legislation and is provided for general informational purposes, not legal advice. It reflects the introduced bill text and publicly reported status through late June 2026. The analysis is based on the text of S. 2367, U.S. Copyright Office materials, congressional testimony, American Bar Association coverage, legal-industry analysis, and statements from creator organizations.