Privacy in the Digital Age: Decoding the AI Consent Act

In a significant move toward safeguarding consumer privacy in the age of artificial intelligence (AI), U.S. Senators Ben Ray Luján and Peter Welch unveiled a bill aimed at enhancing transparency and consent requirements for companies utilizing personal data in training AI systems. The introduction of the Artificial Intelligence Consumer Opt-In, Notification Standards, and Ethical Norms for Training (AI Consent) Act in the U.S. Senate is a pivotal moment for data privacy and technology.

The bill, unveiled on March 19, 2024, seeks to address growing concerns regarding the collection, usage, and transfer of personal data in AI development. Key highlights of the bill include:

Covered data is defined in the bill to include information relating to an individual that is collected by a covered entity when an individual uses a product, tool, platform, or service offered by such entity and such information identifies or is linked or reasonably linkable to the individual or a device, alone or in combination with other information. It also includes derived data and unique persistent identifiers.

The bill stipulates that companies would require consent from consumers to have their data used to train an AI system. It provides that the FTC shall prohibit covered entities from using, selling, or transferring any covered data of an individual to a third party, except when the regulations permit a covered entity to do so after providing the individual with a clear and conspicuous disclosure of how such data will be used by the entity or third party, and obtains express informed consent of the individual to use their data for the disclosed purpose.

Individuals can grant or withdraw consent at any time through an easily accessible mechanism;

The option to withhold or withdraw consent must be equally prominent and require equal or fewer steps than the option of accepting consent;

Consent must be obtained independently of any terms of service agreements;

Consent cannot be assumed from an individual’s actions or inactions, such as hovering over or closing a window;

Services cannot be limited or made conditional based on an individual’s consent; and

If consent is revoked, all data used for AI training must be promptly deleted.

The FTC will oversee and implement regulations issued under the bill, which will entail:

Providing a standard of what constitutes a clear and conspicuous disclosure;

Considering the possibility of and reducing the impact of consumer fatigue toward such disclosure;

Requiring that disclosures clearly states the individual’s applicable rights related to consent, including that services shall not be conditioned on the granting of consent;Requiring that disclosures state how individuals’ data may be used to train AI systems or sold or transferred to a third party doing the same; and

Requiring that such disclosures offer instructions on how an individual may grant or revoke consent.

The bill also states that the FTC shall submit a report on methods used by covered entities to convert data into de-identified data to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives highlighting existing and additional technical measures covered entities could take to ensure that de-identified data cannot be used to re-identify an individual or their device.

The bill further provides that a violation of a regulation promulgated under this Act would be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under the FTC Act. Additionally, the bill clearly specifies that the provisions in this act shall not pre-empt the law of any State that provides greater protection to users of services provided by covered entities and individuals generally than the protections provided under this Act.

The AI Consent Act represents a pivotal step in safeguarding consumer privacy in the era of AI. By enhancing transparency and consent requirements, the bill addresses concerns over personal data use in AI development. This legislation gives individuals more power and sets the stage for ethical AI practices. It is a significant milestone in data privacy protection.

Connect with Ajay Mago or any member of EM³’s Artificial Intelligence practice for professional support.

Ajay Mago is a former AmLaw 100 partner, with more than 16 years of experience in technology transactions, including at Jones Day, Mayer Brown, and Duane Morris. Mr. Mago advises on a wide array of sourcing, technology and other commercial transactions and helps companies navigate legal issues raised by data, emerging technologies, and digital transformation, both on the buyer and provider side. He routinely advises clients on IP strategy, management, and monetization arrangements, leveraging his technology background and business experience.