AI Accountability and Personal Data Protection Act

On July 21, 2025, Senator Josh Hawley (R-MO) introduced the AI Accountability and Personal Data Protection Act (S.2367) in the 119th Congress. The bill establishes a federal tort for any person or entity that appropriates, uses, collects, processes, sells, or otherwise exploits an individual's covered data without their express prior consent. Critically, the bill explicitly includes 'the training of a generative artificial intelligence system' and 'the generation... of any covered data that pertains to an individual' within the definition of prohibited exploitation. The bill was read twice and referred to the Senate Committee on the Judiciary, where it remains as of analysis date. It carries one Democratic cosponsor (Sen. Blumenthal), signaling potential for bipartisan interest but no further action in over nine months — legislative velocity is currently stalled. The bill authorizes no direct government spending. Its economic impact flows entirely through litigation risk and compliance costs imposed on companies whose business models depend on collecting, processing, or training AI on personal data. The mechanism is a pure tort: any violation creates a private right of action for actual damages, statutory damages, and punitive damages. There is no regulatory safe harbor or FTC pre-clearance. This is a direct threat to the data pipelines that power ad targeting, recommendation engines, and generative AI training at major technology platforms. Structural winners under this bill are law firms and litigation finance companies — any public pure-play in litigation funding ($LMFA, $BRK.B indirectly through Berkshire's ownership of Munger Tolles complex) is a beneficiary. Clear losers are large-platform technology companies that monetize user data: META (ad targeting + Llama AI), GOOGL (Search/YouTube ads + Gemini), AMZN (retail recs + Alexa), MSFT (Copilot + Azure AI + LinkedIn), and CRM (Einstein AI + Data Cloud). Smaller AI pure-plays ($AI, $BBAI) are less directly affected as they primarily serve government clients unless they ingest consumer data. Real market data shows significant dispersion on the date of this analysis (2026-04-30). GOOGL has rallied 30.05% in 30 days and sits at $373.96 — within 1% of its all-time high — driven by cloud revenue acceleration and Pixel momentum unrelated to this bill. META has fallen 8.72% in 7 days to $616.14, and MSFT dropped 3.41% in 7 days to $410.15. AMZN is up 30.94% in 30 days to $272.71. CRM is down 4.93% in 30 days to $177.47. The sharp 1-day drops on 4/30 for META (-7.9% intraday implied from close) and MSFT (-3.4%) suggest some investors are now pricing in this legislative risk, whereas GOOGL and AMZN appear to be trading on their own fundamentals without this discount. The legislative timeline is slow. S.2367 needs to pass the Senate Judiciary Committee, secure floor time in a chamber with 60-vote filibuster threshold, pass the House, and be signed by the President — all in the remainder of the 119th Congress (through 2027-01-03). With nine months of inaction and no House companion bill, the probability of enactment in this Congress is below 20%. However, the bill's language is a template that could be revived in the 120th Congress or incorporated into larger privacy legislation with higher passage odds.