II 

118TH CONGRESS 

2D SESSION S. 3975 

To require companies to receive consent from consumers to having their 

data used to train an artificial intelligence system. 

IN THE SENATE OF THE UNITED STATES 

MARCH 19, 2024 

Mr. WELCH (for himself and Mr. LUJA ́N) introduced the following bill; which 

was read twice and referred to the Committee on Commerce, Science, and 

Transportation 

A BILL 

To require companies to receive consent from consumers 

to having their data used to train an artificial intelligence 

system. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Artificial Intelligence 

5 Consumer Opt-in, Notification, Standards, and Ethical 

6 Norms for Training Act’’ or the ‘‘AI CONSENT Act’’. 

7 SEC. 2. DEFINITIONS. 

8 In this Act: 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•S 3975 IS

1 (1) ARTIFICIAL INTELLIGENCE SYSTEM.—The 

2 term ‘‘artificial intelligence system’’ means a ma3 chine-based system that— 

4 (A) is capable of influencing the environ5 ment by producing an output, including pre6 dictions, recommendations or decisions, for a 

7 given set of objectives; and 

8 (B) uses machine or human-based data 

9 and inputs to— 

10 (i) perceive real or virtual environ11 ments; 

12 (ii) abstract these perceptions into 

13 models through analysis in an automated 

14 manner (such as by using machine learn15 ing) or manually; and 

16 (iii) use model inference to formulate 

17 options for outcomes. 

18 (2) COMMISSION.—The term ‘‘Commission’’ 

19 means the Federal Trade Commission. 

20 (3) COVERED DATA.—The term ‘‘covered data’’ 

21 means information relating to an individual that— 

22 (A) is collected by a covered entity in the 

23 course of the individual using a product, tool, 

24 platform, or service offered by the covered enti25 ty; and 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•S 3975 IS

1 (B) identifies or is linked or reasonably 

2 linkable, alone or in combination with other in3 formation, to the individual or a device that 

4 identifies or is linked or reasonably linkable to 

5 the individual, and shall include derived data 

6 and unique persistent identifiers. 

7 (4) COVERED ENTITY.—The term ‘‘covered en8 tity’’ means a person, partnership, or corporation 

9 subject to the jurisdiction of the Commission under 

10 section 5(a)(2) of the Federal Trade Commission 

11 Act (15 U.S.C. 45(a)(2)). 

12 (5) DE-IDENTIFIED DATA.—The term ‘‘de-iden13 tified data’’ means information that has been proc14 essed such that the information does not identify 

15 and is not linked or reasonably linkable to a distinct 

16 individual or a device, regardless of whether the in17 formation is aggregated, and if the covered entity 

18 holding such information— 

19 (A) takes reasonable technical measures to 

20 ensure that the information cannot, at any 

21 point, be used to re-identify any individual or 

22 device that identifies or is linked or reasonably 

23 linkable to an individual; 

24 (B) publicly commits in a clear and con25 spicuous manner— 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•S 3975 IS

1 (i) to process and transfer the infor2 mation solely in a de-identified form with3 out any reasonable means for re-identifica4 tion; and 

5 (ii) to not attempt to re-identify the 

6 information with any individual or device 

7 that identifies or is linked or reasonably 

8 linkable to an individual; and 

9 (C) contractually obligates any person or 

10 entity that receives the information from the 

11 covered entity— 

12 (i) to comply with all of the provisions 

13 of this paragraph with respect to the infor14 mation; and 

15 (ii) to require that such contractual 

16 obligations be included contractually in all 

17 subsequent instances for which the data 

18 may be received. 

19 (6) DERIVED DATA.—The term ‘‘derived data’’ 

20 means covered data that is created by the derivation 

21 of information, data, assumptions, correlations, in22 ferences, predictions, or conclusions from facts, evi23 dence, or another source of information or data 

24 about an individual or an individual’s device. 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•S 3975 IS

1 (7) DEVICE.—The term ‘‘device’’ means any 

2 electronic equipment capable of collecting, proc3 essing, or transferring covered data that is used by 

4 one or more individuals. 

5 (8) TRANSFER.—The term ‘‘transfer’’ means to 

6 disclose, release, disseminate, make available, li7 cense, rent, or share covered data orally, in writing, 

8 electronically, or by any other means. 

9 (9) UNIQUE PERSISTENT IDENTIFIER.—The 

10 term ‘‘unique persistent identifier’’— 

11 (A) means an identifier to the extent that 

12 such identifier is reasonably linkable to an indi13 vidual or device that identifies or is linked or 

14 reasonably linkable to 1 or more individuals, in15 cluding a device identifier, Internet Protocol ad16 dress, cookie, beacon, pixel tag, mobile ad iden17 tifier, or similar technology, customer number, 

18 unique pseudonym, user alias, telephone num19 ber or other form of persistent or probabilistic 

20 identifier that is linked or reasonably linkable 

21 to an individual or device; and 

22 (B) does not include an identifier assigned 

23 by a covered entity for the specific purpose of 

24 giving effect to an individual’s exercise of ex25 press informed consent or revocation of consent 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•S 3975 IS

1 to the collection of covered data to train an ar2 tificial intelligence system. 

3 SEC. 3. DISCLOSURE AND OPT-IN REQUIREMENTS FOR EN4 TITIES THAT USE DATA TO TRAIN ARTIFICIAL 

5 INTELLIGENCE SYSTEMS. 

6 (a) PROHIBITION.—Not later than 1 year after the 

7 date of enactment of this Act, the Commission shall pro8 mulgate regulations under section 553 of title 5, United 

9 States Code, to prohibit covered entities from using or sell10 ing or transferring to a third party any covered data of 

11 an individual that is collected by the covered entity to train 

12 an artificial intelligence system except as provided in sub13 section (b). 

14 (b) USE OF COVERED DATA TO TRAIN ARTIFICIAL

15 INTELLIGENCE SYSTEMS PURSUANT TO EXPRESS IN16 FORMED CONSENT.—The regulations promulgated by the 

17 Commission under subsection (a) shall include the fol18 lowing: 

19 (1) The regulations permit a covered entity to 

20 use covered data of an individual to train an artifi21 cial intelligence system or to sell or transfer such 

22 data to a third party for such purpose if the covered 

23 entity first— 

24 (A) provides the individual with a clear 

25 and conspicuous disclosure of how the covered 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•S 3975 IS

1 entity or third party will use the individual’s 

2 covered data; and 

3 (B) obtains the express informed consent 

4 of the individual for the covered entity or third 

5 party to use the individual’s covered data for 

6 such purpose. 

7 (2) For purposes of the disclosure required 

8 under paragraph (1)(A), the regulations shall— 

9 (A) provide a standard for what con10 stitutes a clear and conspicuous disclosure that 

11 takes into account— 

12 (i) different platform types, including 

13 websites, mobile applications, and search 

14 engines; 

15 (ii) the size, font, color, or other vis16 ual affects of such a disclosure; 

17 (iii) the brevity, accessibility, and clar18 ity of such a disclosure such that it may be 

19 understood by a reasonable person; 

20 (iv) the medium of such a disclo21 sure—including text, audio, and video com22 ponents—and the efficacy of these media 

23 to ensure the individual’s attention and in24 formation; 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•S 3975 IS

1 (v) the timeliness and location of such 

2 a disclosure; and 

3 (vi) any other criteria determined ap4 propriate by the Commission; 

5 (B) consider the possibility of consumer fa6 tigue toward such disclosures and minimize its 

7 impact; 

8 (C) require that the disclosure clearly ex9 plains the individual’s applicable rights related 

10 to consent, including that service shall not be 

11 conditioned on the granting of consent by the 

12 individual; 

13 (D) require that the disclosure state how 

14 an individual’s covered data may be used to 

15 train artificial intelligence systems by the cov16 ered entity or sold or transferred to third par17 ties that may do the same; and 

18 (E) require that the disclosure offer in19 structions on how an individual may grant or 

20 revoke consent. 

21 (3) For purposes of the consent required under 

22 paragraph (1)(B), the regulations shall require 

23 that— 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•S 3975 IS

1 (A) individuals may grant or revoke con2 sent at any time through an accessible and eas3 ily navigable mechanism; 

4 (B) the option to withhold or revoke con5 sent shall be at least as prominent as the option 

6 to accept and shall take the same number of 

7 steps or fewer as the option to accept; 

8 (C) such consent is obtained independently 

9 from the covered entities’ terms of service 

10 agreement; 

11 (D) such consent cannot be inferred from 

12 an individual’s action or inaction, such as hov13 ering over or closing a window or piece of con14 tent; 

15 (E) services provided by a covered entity 

16 may not be reduced, restricted, or made condi17 tional on whether an individual withholds con18 sent; and 

19 (F) should an individual revoke consent, all 

20 covered data of the individual shall be expunged 

21 from datasets used to train an artificial intel22 ligence system following the revocation of con23 sent. 


ssavage on LAPJG3WLY3PROD with BILLS
10 

•S 3975 IS

1 SEC. 4. FTC STUDY ON DATA DE-IDENTIFICATION METH2 ODS. 

3 Not later than 1 year after the date of enactment 

4 of this Act, the Commission shall submit to the Committee 

5 on Commerce, Science, and Technology of the Senate and 

6 the Committee on Energy and Commerce of the House 

7 of Representatives a report on methods used by covered 

8 entities to convert covered data into de-identified data. 

9 Such report shall include an evaluation of whether, given 

10 advancements in artificial intelligence technology, there 

11 are any reasonable technical measures covered entities 

12 could take, in addition to those measures currently used 

13 by covered entities, to ensure that covered data that has 

14 been converted to de-identified data cannot at any point 

15 be used to re-identify an individual or their device. 

16 SEC. 5. ENFORCEMENT. 

17 (a) UNFAIR AND DECEPTIVE ACTS OR PRACTICES.— 

18 A violation of a regulation promulgated under this Act 

19 shall be treated as a violation of a rule defining an unfair 

20 or deceptive act or practice prescribed under section 

21 18(a)(1)(B) of the Federal Trade Commission Act (15 

22 U.S.C. 57a(a)(1)(B)). 

23 (b) POWERS OF THE COMMISSION.— 

24 (1) IN GENERAL.—The Commission shall en25 force regulations promulgated under this Act in the 

26 same manner, by the same means, and with the 


ssavage on LAPJG3WLY3PROD with BILLS
11 

•S 3975 IS

1 same jurisdiction, powers, and duties as though all 

2 applicable terms and provisions of the Federal Trade 

3 Commission Act (15 U.S.C. 41 et seq.) were incor4 porated into and made a part of such regulations. 

5 (2) PRIVILEGES AND IMMUNITIES.—Any person 

6 that violates a regulation promulgated under this 

7 Act shall be subject to the penalties, and entitled to 

8 the privileges and immunities, provided in the Fed9 eral Trade Commission Act (15 U.S.C. 41 et seq.). 

10 (3) REGULATIONS.—The Commission shall, 

11 pursuant to section 553 of title 5, United States 

12 Code, promulgate such regulations as the Commis13 sion determines necessary to carry out the provisions 

14 of this Act. 

15 (4) AUTHORITY PRESERVED.—Nothing in this 

16 Act shall be construed to limit the authority of the 

17 Commission under any other provision of law. 

18 SEC. 6. PREEMPTION. 

19 (a) IN GENERAL.—Nothing in this Act shall be con20 strued to preempt the law of any State that provides 

21 greater protections to users of the services provided by 

22 covered entities and individuals generally than the protec23 tions provided by the regulations promulgated under this 

24 Act. 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•S 3975 IS

1 (b) DEFINITION OF STATE.—In this section, the term 

2 ‘‘State’’ means any of the 50 states, the District of Colum3 bia, the Commonwealth of Puerto Rico, the Virgin Islands 

4 of the United States, Guam, American Samoa, or the 

5 Commonwealth of the Northern Mariana Islands. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS