,,ii #aahth ,,congress #b;d ,session ,s4 #cige ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ai1 #bjbd,mr4 ,welch 7for himself and ,mr4 ,lujn7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require companies to receive consent from consumers to having their data used to train an artificial intelligence system4 #a4 ,short title ,this ,act may be cited as the ,artificial ,intelligence ,consumer ,opt-in1 ,notification1 ,standards1 and ,ethical ,norms for ,training ,act or the ,,ai ,,consent ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,artificial intelligence system ,the term artificial intelligence system means a machine-based system that-- 7,a7 is capable of influencing the environment by producing an output1 including predictions1 recommendations or decisions1 for a given set of objectives2 and 7,b7 uses machine or human-based data and inputs to-- 7i7 perceive real or virtual environments2 7ii7 abstract these perceptions into models through analysis in an automated manner 7such as by using machine learning7 or manually2 and 7iii7 use model inference to formulate options for outcomes4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered data ,the term covered data means information relating to an individual that-- 7,a7 is collected by a covered entity in the course of the individual using a product1 tool1 platform1 or service offered by the covered entity2 and 7,b7 identifies or is linked or reasonably linkable1 alone or in combination with other information1 to the individual or a device that identifies or is linked or reasonably linkable to the individual1 and shall include derived data and unique persistent identifiers4 7#d7 ,covered entity ,the term covered entity means a person1 partnership1 or corporation subject to the jurisdiction of the ,commission under section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b774 7#e7 ,de-identified data ,the term de-identified data means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a device1 regardless of whether the information is aggregated1 and if the covered entity holding such information-- 7,a7 takes reasonable technical measures to ensure that the information cannot1 at any point1 be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual2 7,b7 publicly commits in a clear and conspicuous manner-- 7i7 to process and transfer the information solely in a de-identified form without any reasonable means for re-identification2 and 7ii7 to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual2 and 7,c7 contractually obligates any person or entity that receives the information from the covered entity-- 7i7 to comply with all of the provisions of this paragraph with respect to the information2 and 7ii7 to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received4 7#f7 ,derived data ,the term derived data means covered data that is created by the derivation of information1 data1 assumptions1 correlations1 inferences1 predictions1 or conclusions from facts1 evidence1 or another source of information or data about an individual or an individual's device4 7#g7 ,device ,the term device means any electronic equipment capable of collecting1 processing1 or transferring covered data that is used by one or more individuals4 7#h7 ,transfer ,the term transfer means to disclose1 release1 disseminate1 make available1 license1 rent1 or share covered data orally1 in writing1 electronically1 or by any other means4 7#i7 ,unique persistent identifier ,the term unique persistent identifier-- 7,a7 means an identifier to the extent that such identifier is reasonably linkable to an individual or device that identifies or is linked or reasonably linkable to #a or more individuals1 including a device identifier1 ,internet ,protocol address1 cookie1 beacon1 pixel tag1 mobile ad identifier1 or similar technology1 customer number1 unique pseudonym1 user alias1 telephone number or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or device2 and 7,b7 does not include an identifier assigned by a covered entity for the specific purpose of giving effect to an individual's exercise of express informed consent or revocation of consent to the collection of covered data to train an artificial intelligence system4 #c4 ,disclosure and opt-in requirements for entities that use data to train artificial intelligence systems 7a7 ,prohibition ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to prohibit covered entities from using or selling or transferring to a third party any covered data of an individual that is collected by the covered entity to train an artificial intelligence system except as provided in subsection 7b74 7b7 ,use of covered data ,to train artificial intelligence systems pursuant ,to express informed consent ,the regulations promulgated by the ,commission under subsection 7a7 shall include the following3 7#a7 ,the regulations permit a covered entity to use covered data of an individual to train an artificial intelligence system or to sell or transfer such data to a third party for such purpose if the covered entity first-- 7,a7 provides the individual with a clear and conspicuous disclosure of how the covered entity or third party will use the individual's covered data2 and 7,b7 obtains the express informed consent of the individual for the covered entity or third party to use the individual's covered data for such purpose4 7#b7 ,for purposes of the disclosure required under paragraph 7#a77;,a71 the regulations shall-- 7,a7 provide a standard for what constitutes a clear and conspicuous disclosure that takes into account-- 7i7 different platform types1 including websites1 mobile applications1 and search engines2 7ii7 the size1 font1 color1 or other visual affects of such a disclosure2 7iii7 the brevity1 accessibility1 and clarity of such a disclosure such that it may be understood by a reasonable person2 7iv7 the medium of such a disclosure--including text1 audio1 and video components--and the efficacy of these media to ensure the individual's attention and information2 7v7 the timeliness and location of such a disclosure2 and 7vi7 any other criteria determined appropriate by the ,commission2 7,b7 consider the possibility of consumer fatigue toward such disclosures and minimize its impact2 7,c7 require that the disclosure clearly explains the individual's applicable rights related to consent1 including that service shall not be conditioned on the granting of consent by the individual2 7,d7 require that the disclosure state how an individual's covered data may be used to train artificial intelligence systems by the covered entity or sold or transferred to third parties that may do the same2 and 7,e7 require that the disclosure offer instructions on how an individual may grant or revoke consent4 7#c7 ,for purposes of the consent required under paragraph 7#a77;,b71 the regulations shall require that-- 7,a7 individuals may grant or revoke consent at any time through an accessible and easily navigable mechanism2 7,b7 the option to withhold or revoke consent shall be at least as prominent as the option to accept and shall take the same number of steps or fewer as the option to accept2 7,c7 such consent is obtained independently from the covered entities' terms of service agreement2 7,d7 such consent cannot be inferred from an individual's action or inaction1 such as hovering over or closing a window or piece of content2 7,e7 services provided by a covered entity may not be reduced1 restricted1 or made conditional on whether an individual withholds consent2 and 7,f7 should an individual revoke consent1 all covered data of the individual shall be expunged from datasets used to train an artificial intelligence system following the revocation of consent4 #d4 ,,ftc study on data de-identification methods ,not later than #a year after the date of enactment of this ,act1 the ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,technology of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report on methods used by covered entities to convert covered data into de-identified data4 ,such report shall include an evaluation of whether1 given advancements in artificial intelligence technology1 there are any reasonable technical measures covered entities could take1 in addition to those measures currently used by covered entities1 to ensure that covered data that has been converted to de-identified data cannot at any point be used to re-identify an individual or their device4 #e4 ,enforcement 7a7 ,unfair and deceptive acts or practices ,a violation of a regulation promulgated under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7b7 ,powers of the commission 7#a7 ,in general ,the ,commission shall enforce regulations promulgated under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of such regulations4 7#b7 ,privileges and immunities ,any person that violates a regulation promulgated under this ,act shall be subject to the penalties1 and entitled to the privileges and immunities1 provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,regulations ,the ,commission shall1 pursuant to section #eec of title #e1 ,united ,states ,code1 promulgate such regulations as the ,commission determines necessary to carry out the provisions of this ,act4 7#d7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 #f4 ,preemption 7a7 ,in general ,nothing in this ,act shall be construed to preempt the law of any ,state that provides greater protections to users of the services provided by covered entities and individuals generally than the protections provided by the regulations promulgated under this ,act4 7b7 ,definition of ,state ,in this section1 the term ,state means any of the #ej states1 the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands of the ,united ,states1 ,guam1 ,american ,samoa1 or the ,commonwealth of the ,northern ,mariana ,islands4