AI Frontier Institute

Establishes content and data privacy requirements for chatbot providers.

View primary source →

New Jersey Assembly Bill 5607 (introduced Oct. 5, 2026; referred to the Assembly Public Safety and Preparedness Committee; not enacted) would set data privacy and content rules for AI chatbot providers. Section 1 defines key terms, including "affirmative consent" (which excludes acceptance of general terms of use and consent obtained through dark patterns), "chat log," "profiling," and "training." It also makes chatbot providers "controllers" under P.L.2023, c.266. Section 2 would bar providers from: processing personal data other than input data to inform outputs without a user's express request and affirmative consent; using chat logs to decide on, select, or customize advertisements; processing chat logs or personal data of users the provider knows or should know are under 13 without parental or guardian consent; using data for training when the provider knows or should know a user is under 18, or for users over 18 without prior affirmative consent; profiling beyond what a user's express request requires; selling chat logs; retaining chat logs over two years unless required by law; retaliating against or discriminating against users who refuse training consent or access their chat logs; and implying outputs come from, or are endorsed by, a Title 45 regulated profession or the Judicial Branch/Administrative Office of the Courts, including claiming confidentiality. Violating section 2h is an unlawful practice under the Consumer Fraud Act (P.L.1960, c.39). Section 3 would require providers to publish chatbot information per Attorney General rules, let users access and download chat logs in a portable format, maintain a public written data security program, assess the chatbot for risks of harm to users monthly, and mitigate those risks per Attorney General rules. Section 4 would treat a chatbot as a product for product liability purposes, impose a duty to ensure its use does not injure users, and make providers liable for user injury even if they used all reasonable care or had no direct distribution or contractual relationship with the user. Section 5 would impose a $5,000 civil penalty per violation, allow Attorney General suits for injunctive relief, and give harmed users a private right of action in Superior Court for the greater of actual damages or $5,000 per violation, plus attorney fees and costs. Section 6 directs the Attorney General to adopt implementing rules. Section 7 provides that the act does not limit other state laws and that the law giving users the greatest protection controls in a conflict. Under section 8, the act would take effect on the first day of the sixth month after enactment.

← Back to the tracker