US SB2367

Creates a federal tort allowing individuals to sue anyone who appropriates, uses, collects, processes, sells, or exploits their personal data without express prior consent, including data used to train generative AI systems

Covers broadly defined "covered data" including personally identifiable information, device IDs, IP addresses, geolocation, biometric data, browsing history, and copyrighted content created by individuals

Provides damages of actual damages, treble profits from the data exploitation, or $1,000 minimum, plus punitive damages, injunctive relief, and attorney's fees

Invalidates predispute arbitration agreements and class action waivers for claims under the Act, requiring courts rather than arbitrators to determine applicability

Requires specific disclosure of all third parties receiving data at the time consent is sought, with consent invalid if obtained through coercion, deception, or as a condition of using a product beyond what is reasonably necessary