A5607

An Act establishing content and data privacy requirements for chatbot providers and supplementing Title 56 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):

“Advertisement” means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.

“Affirmative consent” means a clear affirmative act signifying a user’s freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided:

a. the request is provided to the user in a clear and conspicuous standalone disclosure;

b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user’s consent is sought;

c. the request is made in a manner reasonably accessible to and usable by users with disabilities;

d. the request is made available to the user in each language in which the chatbot provider provides a chatbot;

e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and

f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user’s continued use of a chatbot provided by the chatbot provider.

“Affirmative consent” does not include:

a. acceptance of a general or broad terms of use or similar agreement;

b. hovering over, muting, pausing, or closing a given piece of content;

c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or

d. agreement obtained through the use of dark patterns.

“Artificial intelligence chatbot” or “chatbot” means a software application, web interface, or computer program that simulates human conversation and interaction through text, visual images, video, or aural communications.

“Artificial intelligence technology” means any technology involving the development or implementation of machine-based systems that, for explicit or implicit objectives, infer, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that may influence physical or virtual environments.

“Chat log” means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.

“Chatbot provider” means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. “Chatbot providers” are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).

“Collect” means to create, buy, rent, gather, obtain, receive, access, or otherwise acquire personal data or input data by any means through an individual’s use of chatbots.

“Dark pattern” means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).

“De-identified data” means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).

“Input data” means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. “Input data” includes personal data.

“Personal data” means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. “Personal data” does not include de-identified data or publicly available information.

“Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.

“Profiling” means any form of processing performed on input data or personal data to detect and clarify or designate personality and behavioral characteristics of an individual. “Profiling” does not include the processing of chat logs for purposes of user safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).

“Publicly available information” means information that has been lawfully made available to the general public from:

a. federal, State, or municipal government records, if the person collects, processes, and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity;

b. widely distributed media; or

c. a disclosure to the general public as required by federal, State, or local law.

“Publicly available information” does not include:

a. any obscene visual depiction, as “visual depiction” is defined in 18 U.S.C. s.1460;

b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4);

c. personal data that is created through the combination of personal data with publicly available information;

d. information that is collated and combined to create user profiles on publicly available or subscription-based websites and inferences generated from such information;

e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains;

f. information made available by a user on a website or online service made available to all members of the public, for free or for a fee, where the user has restricted the information to a specific audience; or

g. intimate images, either authentic or computer-generated, known to be nonconsensual.

“Sell” means exchanging personal data or input data for monetary or other valuable consideration, or making available such data or use of such data, by the chatbot provider to a third party. “Sell” does not include:

a. the disclosure of personal data or input data to a third party that processes the data on behalf of the chatbot provider;

b. with the user’s affirmative consent, the disclosure of personal data or input data where the user affirmatively directs the chatbot provider to disclose the data or intentionally uses the chatbot provider to interact with a third party; or

c. the disclosure of personal data that the user intentionally made available to the public through a channel of widely-distributed media and did not restrict to a specific audience.

“Training” means the use of input data to adjust or modify an artificial intelligence technology. “Training” does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.

“User” means any natural person, regardless of age.

“Widely-distributed media” means information that is available to the public, including information from a telephone book or online directory, a television, the Internet, or a radio program, the news media, or an Internet site that is available to the public on an unrestricted basis. “Widely-distributed media” does not include an obscene visual depiction, as “visual depiction” is defined in 18 U.S.C. s.1460.

2. A chatbot provider shall not:

a. process personal data other than input data to inform chatbot outputs unless the processing of personal data is necessary to fulfill an express request made by a user and that user has provided affirmative consent for such processing;

b. process a user’s chat log:

(1) to determine whether to display an advertisement for a product or service to the user;

(2) to determine a product, service, or category of product or service to advertise to the user; or

(3) to customize an advertisement or determine how an advertisement is presented to the user;

c. process a user’s chat log or personal data:

(1) if the chatbot provider knows or should know that the user is under 13 years of age, without the affirmative consent of that user’s parent or legal guardian;

(2) for training purposes, if the chatbot provider knows or should know, based on the knowledge fairly implied on the basis of objective circumstances, that a user is under 18 years of age;

(3) for training purposes, if a user is over 18 years of age and the chatbot provider has not obtained the user’s prior affirmative consent; or

(4) to engage in profiling beyond what is necessary to fulfill an express request from the user;

d. use any classification or designation of a user’s personality or behavioral characteristics created through profiling beyond what is necessary to fulfill an express request made by a user;

e. sell a user’s chat log;

f. retain a user’s chat log for longer than two years, unless retention is necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or is otherwise required by law; or

g. discriminate or retaliate against any user, including by denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the user, for refusing to consent to the use of a chat log or personal data for training purposes or for accessing the user’s chat log.

3. A chatbot provider shall:

a. make information about its chatbot available on the chatbot provider’s Internet website as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill);

b. retain in a portable and readily-usable format and make available for a user to access and download at any time any of the user’s chat logs;

c. develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal data and chat logs maintained by the chatbot provider. The program shall be written and made publicly available on the chatbot provider’s Internet website;

d. assess its chatbot for risks of harm to users on a monthly basis, according to metrics as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill); and

e. mitigate any risks of harm as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill).

4. a. A chatbot shall be considered a product for the purposes of a product liability action.

b. A chatbot provider shall have a duty to ensure that the use of its chatbot does not cause injury to a user.

c. A chatbot provider shall be liable for any injury to a user from the use of its chatbot, even if:

(1) the chatbot provider exercised all reasonable care in the design and distribution of the chatbot; or

(2) the chatbot provider did not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user.

5. a. A chatbot provider that violates the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall be subject to a civil penalty of $5,000 for each violation, to be collected in a civil action by a summary proceeding under the “Penalty Enforcement Law of 1999,” P.L.1999, c.274 (C.2A:58-10 et seq.). The Superior Court and the municipal court shall have jurisdiction to enforce the provisions of the “Penalty Enforcement Law of 1999,” P.L.1999, c.274 (C.2A:58-10) pursuant to this section.

b. The Attorney General may bring a civil action for injunctive relief against a chatbot provider who violates the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) or any rules, regulation, or orders promulgated thereunder.

c. (1) A user who has been harmed by a violation of sections 2 or 3 of P.L. , c. (C. or C. ) (pending before the Legislature as this bill) may bring a civil action against the chatbot provider. An action pursuant to this subsection shall be brought in the Superior Court of the county in which the individual bringing the action resides.

(2) If a court finds that a chatbot provider has violated sections 2 or 3 of P.L. , c. (C. or C. ) (pending before the Legislature as this bill), the individual bringing an action pursuant to this section shall be entitled to:

(a) the greater of actual damages or $5,000 for each violation; and

(b) reasonable attorney fees and court costs.

6. The Attorney General shall adopt, pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.), rules and regulations as may be necessary to implement the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill).

7. a. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not limit or restrict in any way the application of other laws, statutes, rules, or regulations of this State.

b. In the event of a conflict between P.L. , c. (C. ) (pending before the Legislature as this bill) and one or more other laws of this State, the law that affords the greatest protection from harm to users shall control.

8. This act shall take effect on the first day of the sixth month following the date of enactment. However, the Attorney General may take any anticipatory action in advance as shall be necessary for the implementation of this act.

STATEMENT

This bill establishes content and data privacy requirements for chatbot providers.

Under the bill, chatbot providers are prohibited from: (1) processing personal data other than input data to inform chatbot outputs unless the processing of personal data is necessary to fulfill an express request made by a user and that user has provided affirmative consent; (2) processing a user’s chat log under certain circumstances regarding advertisements; (3) processing a user’s chat log or personal data under certain circumstances; (4) using any classification or designation of a user’s personality or behavioral characteristics created through profiling beyond what is necessary to fulfill an express request made by a user; (5) selling a user’s chat log; (6) retaining a user’s chat log for longer than two years unless required by law; or (7) discriminating or retaliating against any user for refusing to consent to the use of a chat log or personal data for training purposes or for accessing their own chat log.

Additionally, a chatbot provider is required to: (1) make certain information about its chatbot available on the chatbot provider’s Internet website; (2) retain in a portable and readily-usable format and make available for a user to access and download at any time any of the user’s chat logs; (3) develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal data and chat logs maintained by the chatbot provider; (4) assess the chatbot for risks of harm to users on a monthly basis; and (5) mitigate any risks of harm pursuant to the rules promulgated by the Attorney General under the bill.

Under the bill, a chatbot is considered a product for the purposes of a product liability action, and a chatbot provider has a duty to ensure that the use of its chatbot does not cause injury to a user.

A chatbot provider that violates the bill’s provisions is to be liable for a civil penalty in the amount of $5,000 for each violation, and the Attorney General may bring a civil action for injunctive relief against the chatbot provider. The bill also permits a user who has been harmed by a violation of certain provisions of the bill to bring an action in the Superior Court against a chatbot provider. If the suit is successful, an individual would be entitled to: (1) the greater of actual damages or $5,000 for each violation; and (2) reasonable attorney fees and court costs.