Assembly Committee Passes Chatbot User Protection Bill

TRENTON - Recognizing the bill's limitations and the need for much deeper examination of the AI superhighway, the Assembly Public Safety and Preparedness Committee this morning passed A-5607, which attempts to regulate chatbot providers against manipulative pattern matching behaviors.
"What this bill does is it takes all reasonable care to protect he chatbot user - explicitly making it a product under the liability framework, ensuring [chatbot provider is] taking care not to cause injury," said Assemblyman Joe Danielsen (D), chair of the committee (pictured).
Assemblyman Antwan McClellan (R) opposed the bill.
LISTEN TO ASSEMBLYWOMAN SWEENEY DISCUSS ANOTHER AI REGULATORY BILL HERE.
Not everyone on the committee liked the bill.
"Some cavemen on the side who didn't discover fire who are now trying to stomp it out quickly," said Assemblyman Paul Kanitra (R).
He eventually abstained.
"I have certain reservations," admitted Assemblywoman Carol Murphy (D), who - for now - voted yes.
Others celebrated the bill.
The Consumer Federation of America (CFA) recommended passage of the bill.
Beverly Brown Ruggia of CFA and Nj Citizen Action said, "All ages are impacted [by manipulative chatbots]. The good news is chatbots aren't people. Straightforward rules can make them safer. We can't rely on promises by tech CEOs. We need rules. It's critically important of not waiting to correct the mistake."
Ruggia described the bill as "the right approach."
Although the committee proceeded to move the legislation, questions remained about the effectiveness of the bill, including lack of clarity about geographic scope.
This bill establishes content and data privacy requirements for chatbot providers.
Under the bill, chatbot providers are prohibited from: (1) processing personal data other than input data to inform chatbot outputs unless the processing of personal data is necessary to fulfill an express request made by a user and that user has provided affirmative consent; (2) processing a user’s chat log under certain circumstances regarding advertisements; (3) processing a user’s chat log or personal data under certain circumstances; (4) using any classification or designation of a user’s personality or behavioral characteristics created through profiling beyond what is necessary to fulfill an express request made by a user; (5) selling a user’s chat log; (6) retaining a user’s chat log for longer than two years unless required by law; or (7) discriminating or retaliating against any user for refusing to consent to the use of a chat log or personal data for training purposes or for accessing their own chat log.
Additionally, a chatbot provider is required to: (1) make certain information about its chatbot available on the chatbot provider’s Internet website; (2) retain in a portable and readily-usable format and make available for a user to access and download at any time any of the user’s chat logs; (3) develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal data and chat logs maintained by the chatbot provider; (4) assess the chatbot for risks of harm to users on a monthly basis; and (5) mitigate any risks of harm pursuant to the rules promulgated by the Attorney General under the bill.
Under the bill, a chatbot is considered a product for the purposes of a product liability action, and a chatbot provider has a duty to ensure that the use of its chatbot does not cause injury to a user.
A chatbot provider that violates the bill’s provisions is to be liable for a civil penalty in the amount of $5,000 for each violation, and the Attorney General may bring a civil action for injunctive relief against the chatbot provider. The bill also permits a user who has been harmed by a violation of certain provisions of the bill to bring an action in the Superior Court against a chatbot provider. If the suit is successful, an individual would be entitled to: (1) the greater of actual damages or $5,000 for each violation; and (2) reasonable attorney fees and court costs.
