The Blumenthal-Hawley bill doesn’t mince words. It calls what AI companies are doing “the largest intellectual property theft in American history,” and then offers a legal remedy: a federal tort for creators and consumers whose data or works have been scraped, trained on, or mimicked without consent.
The bill’s core premise is simple: if your copyrighted work or personal data is used by an AI model without your express, prior consent, you can sue. Not ask nicely. Not file a complaint with a regulatory body. Sue.
This is a response to the growing number of lawsuits from authors, musicians, and visual artists who have discovered their work embedded in training datasets and then resurfacing in AI-generated outputs. Those suits have been forced to navigate the shifting terrain of fair use, a new-ish transformative use test on the heels of AWF, and of course the very real limits of copyright law. This bill bypasses all of that, creating a new cause of action that does not rely on, or really even concern itself with, Title 17. It is tort-based, not infringement-based, and that distinction may prove decisive.
The bill defines “covered data” broadly. It includes personally identifiable information, device identifiers, biometric data, behavioral profiles, and copyrighted content, whether registered or not. That last point is critical. It removes the procedural barrier of registration and allows creators to assert rights over their work without having to first file with the Copyright Office. If material (“content” as the robber barons and mine-toilers call it) is yours, and it’s been used, you have standing. This may need more refinement as this bill goes into, and comes out of, committee.
The bill also addresses the right of publicity, which varies widely across states. By allowing individuals to sue for unauthorized use of biometric data, behavioral profiles, and likenesses, the bill creates a federal overlay that could standardize protections nationwide. In states with strong publicity rights, this reinforces existing law. In states with weaker protections, it may fill the gaps. Of course, not every state takes rights of personality in the same direction, or coming from the same perspective: some of them treat them as property rights where they have been exploited economically in the past, and others treat them as privacy rights and extend to all individuals, market value or not.
To that end, the privacy provisions are strict. Companies must obtain affirmative, informed consent before using any personal data. They must also disclose every third party who will access that data. This serves as a transparency requirement and a litigation roadmap. It also presents a serious compliance challenge for companies that rely on opaque or decentralized data supply chains. And then there’s the Section 230 carve-out. The bill explicitly removes immunity for AI-generated content, meaning platforms can be held liable for what their models produce. That’s a direct challenge to the current regime, where intermediaries are largely shielded from responsibility.
Blumenthal’s framing is constitutional as much as it is commercial. He’s arguing that consumers and creators deserve enforceable, private rights of action, not just regulatory protections. That enforcement, in his view, should come from the courts, not just the FTC or the Copyright Office.
But if enforcement is left to individuals and the private right of action is the primary mechanism, does that just turn accountability into another game of whack-a-mole? One plaintiff, one lawsuit, one settlement at a time? Attorneys General, elected, being responsive when enough of their citizens can find and articulate a colorable claim? How might one come to know this is even an option for them if they were inclined to initiate an action? Solicitation rules largely limit attorneys from finding causes of action and thenmathcin time with individuals. Attorneys General could take matters into their own hands on behalf of their states, and citizens thereof, but of course any awards from those actions go back into the state coffers.
So, this AI Act, it’s a powerful tool, but a fragmented one. The question is whether it can be paired with a regulatory mandate. Could the same statute empower both the courts and a federal agency? Could it create a dual-track system where individuals can sue, but regulators can also act proactively, at scale? That’s not just a structural question but rather a strategic one;if the goal is to change behavior across an industry, not just compensate the harmed, then litigation alone may not be enough.
The bill doesn’t resolve the deeper questions about what constitutes infringement in the age of generative AI. It doesn’t define what it means to “mimic” a work, or how close is too close. But it does something arguably more important: it gives plaintiffs a path to court that doesn’t depend on the Copyright Act’s limitations. In that sense, it’s less about addressing or reframing copyright law and more about supplementing it to create a parallel track for redress when the existing one proves too narrow.
Whether it survives committee markup or makes it to the floor is another matter. I’d suspect the broadness is designed to bring together a larger conversation that will end up more refined. But it’s a signal that a bipartisan sect of Congress is no longer content to let courts sort it out piecemeal. And it’s a warning shot to AI developers: the era of unregulated mining may be coming to a close.