Artificial Intelligence Civil Rights Act of 2025
A BILL
To establish protections for individual rights with respect to computational algorithms, and for other purposes.
Sec. 2 Definitions
In this Act:
Collect; collection— The terms collect and collection, with respect to personal data, mean buying, renting, gathering, obtaining, receiving, accessing, or otherwise acquiring such data by any means.
Commercial act— The term commercial act, with respect to a covered algorithm, means an act conducted for monetary or other valuable consideration, including conducting an activity in furtherance of obtaining such consideration.
Commission— The term Commission means the Federal Trade Commission.
Consequential action— The term consequential action means an act that is likely to have a material effect on, or to materially contribute to, access to, security and authentication relating to, eligibility for, cost of, terms of, or conditions related to any of the following:
Employment, including hiring, pay, independent contracting, worker management, promotion, and termination.
Education and career and technical education, including assessment, proctoring, promotion of academic integrity, accreditation, certification, admissions, enrollment, disciplinary actions including suspension, expulsion, or referral to law enforcement, eligibility for graduation, grade promotion or degree conferral, academic performance evaluation, and provision of financial aid and scholarships.
Housing and lodging, including rental and short-term housing and lodging, home appraisals, rental subsidies, publicly supported housing, and mortgage lending.
Essential utilities, including electricity, heat, water, municipal trash or sewage services, internet and telecommunications service, and public transportation.
Health care, including mental health care, and dental, vision, and adoption services, and other health care-related services, treatment options, trials, and studies.
Credit, banking, and other financial services.
Insurance, including insurance claim determinations.
Actions of the criminal justice system, law enforcement or intelligence operations, immigration determinations or enforcement, border control (vetting, screening, and inspection), child protective services, child welfare, and family services, including risk and threat assessments, situational awareness and threat detection, investigations, watchlisting, bail determinations, sentencing, administration of parole, surveillance, use of unmanned vehicles and machines, and predictive policing.
Justice and determinations concerning guilt or liability, including assignment of cases or counsel, bail determinations, pre-detention risk assessments, case intake, sequencing, and processing, awards of actual or punitive damages, and binding and nonbinding determinations in arbitration, mediation, or other alternative dispute resolution.
Elections, including voting, requirements for documentation or proof of identity to vote or register to vote (and determinations about whether an individual meets those requirements), redistricting, polling place resources, reduction or alteration of multilingual or English language voting materials, alteration of the manner in which voting materials are provided or distributed, reduction, consolidation, or relocation of voting locations in elections for Federal, State, or local office (including early, absentee, and election-day voting locations), reduction in days or hours of in-person voting during a period occurring prior to the date of an election for Federal, State, or local office during which voters may cast ballots in such election, election security, and election administration, including maintenance processes for voter registration lists that add a new basis for removal from the list of active voters registered to vote in elections for Federal, State, or local office, or that incorporate a new source of information in determining a voter’s eligibility to vote in elections for Federal, State, or local office.
Government benefits and services, as well as verification of identity, citizenship, and immigration status, fraud prevention, and assignment of penalties.
A public accommodation.
Any other service, program, product, or opportunity which has a comparable legal, material, or similarly significant effect on an individual’s life as determined by the Commission through rules promulgated pursuant to section 553 of title 5, United States Code.
Covered algorithm— The term covered algorithm means—
a computational process derived from machine learning, natural language processing, artificial intelligence techniques, or other computational processing techniques of similar or greater complexity, that, with respect to a consequential action—
creates or facilitates the creation of a product or information that is used as an integral part of the consequential action;
promotes, recommends, ranks, or otherwise affects the display or delivery of information that is used as an integral part of the consequential action;
makes a decision; or
facilitates human decision making; or
any other computational process deemed appropriate by the Commission through rules promulgated pursuant to section 553 of title 5, United States Code.
Covered language— The term covered language means the 10 languages with the most speakers in the United States, according to the most recent data collected by the United States Census Bureau.
De-identified data— The term de-identified data means information—
that does not identify and is not linked or reasonably linkable to an individual or a device, regardless of whether the information is aggregated; and
with respect to which any developer or deployer using such information—
takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual;
publicly commits in a clear and conspicuous manner—
to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and
to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and
contractually obligates any person that receives the information from the developer or deployer—
to comply with all of the provisions of this paragraph with respect to such information; and
to require that such contractual obligations be included in all subsequent instances for which the information may be received.
Deployer—
In general— The term deployer means any person that uses a covered algorithm for a commercial act.
Rule of construction— The terms deployer and developer shall not be interpreted to be mutually exclusive.
Developer—
In general— The term developer means any person that designs, codes, customizes, produces, or substantially modifies an algorithm that is intended or reasonably likely to be used as a covered algorithm—
for such person's own use, or use by a third party, in connection with a commercial act; or
for use by a government entity.
Assumption of developer responsibilities— In the event that a deployer uses an algorithm as a covered algorithm, and no person is considered the developer of the algorithm for purposes of subparagraph (A), the deployer shall be considered the developer of the covered algorithm for the purposes of this Act.
Rule of construction— The terms developer and deployer shall not be interpreted to be mutually exclusive.
Disparate impact—
In general— The term disparate impact means an unjustified differential effect on an individual or group of individuals on the basis of an actual or perceived protected characteristic.
Unjustified differential effect— For purposes of subparagraph (A), with respect to the action, policy, or practice of a developer or deployer, a differential effect is unjustified if—
the developer or deployer fails to demonstrate that such action, policy, or practice causing the differential effect is necessary to achieve a substantial, legitimate, and nondiscriminatory interest; or
in the event the developer or deployer demonstrates such interest, an alternative action, policy, or practice could serve such interest with less differential effect.
Application to covered algorithms— With respect to demonstrating that a covered algorithm causes or contributes to a differential effect, the covered algorithm is presumed to be not separable for analysis and may be analyzed holistically as a single action, policy, or practice, unless the developer or deployer proves that the covered algorithm is separable by a preponderance of the evidence.
Harm— The term harm, with respect to a consequential action, means a non-de minimis adverse effect on an individual or group of individuals—
on the basis of a protected characteristic;
that involves the use of force, coercion, harassment, intimidation, or detention; or
that involves the infringement of a right protected under the Constitution of the United States.
Independent auditor—
In general— The term independent auditor means an individual that conducts a pre-deployment evaluation or impact assessment of a covered algorithm in a manner that exercises objective and impartial judgment on all issues within the scope of such evaluation or assessment.
Exclusion— An individual is not an independent auditor of a covered algorithm if such individual—
is or was involved in using, developing, offering, licensing, or deploying the covered algorithm for a commercial act;
at any point during the pre-deployment evaluation or impact assessment, has an employment relationship (including a contractor relationship, but not including a contractor relationship for the auditing service described in subparagraph (A)) with a developer or deployer that uses, offers, or licenses the covered algorithm; or
at any point during the pre-deployment evaluation or impact assessment, has a direct financial interest, a reasonably foreseeable future financial interest, or a material indirect financial interest in a developer or deployer that uses, offers, or licenses a covered algorithm, not including routine payment for the auditing services described in subparagraph (A).
Individual— The term individual means a natural person in the United States.
Personal data—
In general— The term personal data—
means information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or an individual's device; and
shall include derived data and unique persistent identifiers.
Exclusion— The term personal data does not include de-identified data.
Process— The term process, with respect to personal data, means to conduct or direct any operation or set of operations performed on such data, including analyzing, organizing, structuring, retaining, storing, using, or otherwise handling such data.
Protected characteristic— The term protected characteristic means any of the following actual or perceived traits of an individual or group of individuals:
Race.
Color.
Ethnicity.
National origin, nationality. or immigration status.
Religion.
Sex (including a sex stereotype, pregnancy, childbirth, or a related medical condition, sexual orientation or gender identity, and sex characteristics, including intersex traits).
Disability.
Limited English proficiency.
Biometric information.
Familial or marital status.
Source of income.
Income level (not including the ability to pay for a specific good or service being offered).
Age.
Veteran status.
Genetic information or medical conditions.
Any other classification protected by Federal law.
Public accommodation—
In general— The term public accommodation means—
a business that offers goods or services to the general public, regardless of whether the business is operated for profit or operates from a physical facility;
a park, road, or pedestrian pathway open to the general public;
a means of public transportation; or
a publicly owned or operated facility open to the general public.
Exclusions— The term public accommodation does not include a private club or establishment described in section 101(b)(2).
State— The term State means each of the 50 States, the District of Columbia, Puerto Rico, the United States Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.
State data protection authority— The term State data protection authority means an independent public authority of a State that supervises, investigates, and regulates data protection and security law in the State, including handling complaints lodged against persons for violations of State and relevant Federal laws.
Transfer— The term transfer, with respect to personal data, means to disclose, release, disseminate, make available, license, rent, or share such data orally, in writing, electronically, or by any other means.