New Jersey is moving to treat AI chatbots as products under the state’s product liability law, and make their makers strictly liable for injuries their products cause – even if the company was careful and had no direct contract with the user.
A bill to this effect, A5607, was introduced on October 5, and after passing the Assembly Public Safety and Preparedness Committee on October 19, has been sent to the Appropriations Committee.
This means that users who are harmed by violations of the bill’s provisions could sue chatbot makers for actual damages or $5,000 per violation, while the attorney general would be able to seek civil penalties of $5,000 per violation.
The New Jersey bill would also restrict the use of chat logs and personal data for advertising, profiling, and training AI. This would represent a real gain for users, who are currently often subjected to this type of data harvesting and exploitation by tech companies.
The bill would also require providers to keep users’ chat logs and allow them to download these logs. What this means is that while on the one hand, users would have more control over their data, on the other, the provider would be forced to keep a record of all conversations that take place on their platform.
That is a store of highly personal and intimate records that can be accessed by law enforcement, other litigants, and hackers.
This is not merely theoretical, as we reported in October about a Florida woman who used the Claude chatbot as a “diary” – and got arrested after the system flagged one of her entries as suspicious. The local sheriff’s office then warned people that they are “never truly anonymous” when using AI.
The New Jersey bill’s provisions that are supposed to protect users’ privacy and safety could ultimately backfire, as the strict liability standard that would be imposed on companies could lead to even more surveillance of users.
As lawyer Scott S. Christie told Law.com, the bill would “open the floodgates” and explained that, “When there’s $5,000 in statutory damages per violation and you don’t have to prove any harm, in addition to the strict liability standard, you’re talking hundreds of thousands and perhaps millions of dollars per lawsuit.”
He also explained that the way the bill is written means that if a chatbot provider violates the statute with one user, “it’s probably violating as to all users.”
To avoid this, the obvious course of action for companies would be to watch their users more closely, verify their identities, and report them to the authorities when the algorithm decides that is warranted.
We have already reported about lawsuits that are trying to establish that not scanning users’ private conversations and reporting them to the police is a product defect (the case of Joshi v. OpenAI Foundation, regarding the Florida State University shooting), and others (following the Tumbler Ridge shooting in Canada) that seek to force companies to implement ID verification and refer users to the police.
A5607 has the support of the Electronic Privacy Information Center (EPIC), who said that the bill is based on a model bill, and that a strong liability structure is necessary because “many of the major chatbot companies have proven over and over again that they will not voluntarily prioritize user safety over profits.”
In a letter to the New Jersey Assembly committee, EPIC also wrote that these companies “take the sensitive information that people tell chatbots and use it for profit” and that AI companies “cannot be trusted to self-regulate.”
In the end, the only way companies will be able to protect themselves from the strict liability the New Jersey bill introduces is by making sure they know who is using their product, and what they are doing on it. And this is not the kind of protection that users need.
The data limits imposed by the bill are worth having, but the risk is that a liability regime this broad turns every chatbot into a supervised, ID-checked, and logged channel – because the safest product under this law is one that watches its users. New Jersey should keep the privacy rules, and drop the incentive to surveil.
