Bill would let people sue over data used without clear consent

What does this do?

S 2367 would create a federal law letting people sue companies or individuals who use their personal data without clear, upfront permission. It covers names, location, browsing habits, biometric data, AI training on personal data, and AI-generated content based on a real person's data or copyrighted material. Winners could collect actual losses, triple profits or at least $1,000, punitive damages, and legal fees.

Who does it affect?

This affects tech companies, AI developers, data brokers, and businesses that collect consumer data, as well as everyday consumers whose data is used.

Why does it matter?

Companies could face lawsuits and financial penalties for using data without valid consent, forced arbitration clauses over these violations would be void, and stronger state privacy laws would remain in effect.

What does it cost, and who pays?

• Actual losses or triple profits
• Minimum $1,000 per violation
• Punitive damages plus legal fees