In a significant move toward safeguarding consumer privacy in the age of artificial intelligence (AI), US Senators Ben Ray Luján and Peter Welch unveiled a bill aimed at enhancing transparency and consent requirements for companies utilizing personal data in training AI systems. The introduction of the Artificial Intelligence Consumer Opt-In, Notification Standards, and Ethical Norms for Training (AI Consent) Act to the US House of Representatives marks a pivotal moment in the ongoing discourse surrounding data privacy and the ethical use of AI technology.
The bill, unveiled on March 19, 2024, seeks to address growing concerns regarding the collection, usage, and transfer of personal data in AI development. Key highlights of the bill include:
1) Definition of Covered Data:
Covered data is defined in the bill to include information relating to an individual that is collected by a covered entity when an individual uses a product, tool, platform, or service offered by such entity and such information identifies or is linked or reasonably linkable to the individual or a device, alone or in combination with other information. It also includes derived data and unique persistent identifiers.
2) Usage of Data:
The bill stipulates that companies would require consent from consumers to have their data used to train an AI system. It provides that the FTC shall prohibit covered entities from using, selling, or transferring any covered data of an individual to a third party, except when the regulations permit a covered entity to do so after providing the individual with a clear and conspicuous disclosure of how such data will be used by the entity or third party, and obtains express informed consent of the individual to use their data for the disclosed purpose.
3) Consent Mechanism and Provisions:
- Individuals can grant or withdraw consent at any time through an easily accessible mechanism;
- The option to withhold or withdraw consent must be equally prominent and require equal or fewer steps than the option of accepting consent;
- Consent must be obtained independently of any terms of service agreements;
- Consent cannot be assumed from an individual’s actions or inactions, such as hovering over or closing a window;
- Services cannot be limited or made conditional based on an individual’s consent; and
- If consent is revoked, all data used for AI training must be promptly deleted.
4) Disclosure Regulations
The FTC will oversee and implement regulations issued under the bill, which will entail:
- Providing a standard of what constitutes a clear and conspicuous disclosure;
- Considering the possibility of and reducing the impact of consumer fatigue towards such disclosure;
- Requiring that disclosures clearly states the individual’s applicable rights related to consent, including that services shall not be conditioned on the granting of consent;Requiring that disclosures state how individuals’ data may be used to train AI systems or sold or transferred to a third party doing the same; and
- Requiring that such disclosures offer instructions on how an individual may grant or revoke consent.
5) FTC Oversight
The bill also states that the FTC shall submit a report on methods used by covered entities to convert data into de-identified data to the Committee on Commerce, Science, and Technology of the Senate and the Committee on Energy and Commerce of the House of Representatives highlighting existing and additional technical measures covered entities could take to ensure that de-identified data cannot be used to re-identify an individual or their device.
6) Enforcement and State Pre-emption
The bill further provides that a violation of a regulation promulgated under this Act would be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under the FTC Act. Additionally, the bill clearly specifies that the provisions in this act shall not pre-empt the law of any State that provides greater protection to users of services provided by covered entities and individuals generally than the protections provided under this Act.
The AI Consent Act represents a pivotal step in safeguarding consumer privacy in the era of AI. By enhancing transparency and consent requirements, the bill addresses concerns over personal data use in AI development. This legislation not only empowers individuals but also sets the stage for ethical AI practices, marking a significant milestone in data privacy protection.
You can access the bill by following this link.
Looking for guidance on your AI implementation journey?
Connect with Ajay Mago or any member of EM3’s Artificial Intelligence practice for professional support.
Ajay Mago, Managing Partner at Maxson Mago & Macaulay, LLP (EM3 Law LLP).
Disclaimer: This publication is for information purposes only and should not be construed as legal advice or a substitute for legal counsel. This information is not intended to create an attorney-client relationship. Do not send us any unsolicited confidential information unless and until a formal attorney-client relationship has been established. EM3 Law is under no duty of confidentiality to persons sending unsolicited messages, e-mails, mail, facsimiles and/or any other information by any other means to our firm or attorneys prior to the formal establishment of such relationship. The views and opinions expressed herein are those of the author(s) and do not necessarily reflect the views of the firm.