Relating to restrictions on the use of artificial intelligence, and creating a civil cause of action

The bill defines “developer” as a person who, in this state, creates or substantially modifies AI or an application (app) that uses AI. The bill defines “device company” as a person engaged in the business of manufacturing smart devices and that has a registered office, a registered agent, or a business office in this state.101, that engages in the business of manufacturing smart devices. The bill defines “initialize” as the process of starting a smart device and associate the smart device with a new user account. The bill defines “private data” as data that AI, or an app that includes AI, accesses on a smart device, and that is not content generated by using the AI or the app on the smart device, or content to which the AI’s developer or the app’s developer had previously received authorization to access for purposes described in the smart device’s statement of purpose or the app’s statement of purpose. The bill defines “smart device” as a computer, smartphone, gaming console, tablet computer, or other electronic device capable of running software to download, install, or use AI and that was sold in this state on or after July 1, 2025. The bill defines “statement of purpose” as a statement made for an app or smart device that explains the types of private data the app or smart device was designed to access; how the private data will be used, including the types of new content the private data will be used to generate and how the new content will be used; and if the app or smart device is designed to save, copy, or otherwise transfer private data to a location outside the smart device, an explanation of how and where private data will be maintained, disseminated, and deleted, as applicable. If a device company makes a smart device available for purchase with AI installed on the smart device, the bill requires the device company to cause an agreement to appear when a user initializes the smart device. The agreement must contain a notice to the smart device’s user that the smart device has AI installed on the smart device; if the smart device’s AI is designed to access the user’s private data, the smart device’s statement of purpose (SOP); and an option to uninstall the AI. If the smart device’s user does not uninstall the AI, the device company needs to cause an interactive form to appear that will allow the smart device’s user to refuse the smart device’s AI access to each type of private data the AI is designed to access on the smart device prior to the AI accessing the private data. The agreement must be separate from any other agreement or disclaimer the device company requires or is required to create for the smart device, including but not limited to terms of service agreements and end user license agreements. If a device company changes any information contained in the SOP for a smart device, the bill requires the device company to update the agreement containing the smart device’s SOP, and cause the updated agreement to appear on each smart device affected by the change and which has not authorized or refused access to private data based on the change. If a device company causes AI to be installed on a smart device the device company manufactured, the bill prohibits the device company from permitting the AI installed on the smart device to access a type of private data that the AI was not authorized to access in an agreement containing the smart device’s SOP; using private data accessed by the AI in a manner that is not stated in the smart device’s SOP; if the AI saves, copies, or otherwise transfers private data to a location outside a smart device from which the private data originated, maintaining, disseminating, or deleting the private data in a manner that is inconsistent with the smart device’s SOP. The bill contains provisions for an app developer which are similar to the requirements and prohibitions for a device company if the app developer makes an app that includes AI available for general use and the app is designed to access private data. The bill prohibits a device company from requiring a smart device user to install AI on the smart device as a condition to use the smart device. The bill requires a device company to include clearly identifiable means to allow a user to uninstall artificial intelligence from a smart device if the artificial intelligence was installed on the smart device due to an action taken by the device company. The bill prohibits a person from using AI to intentionally recreate the audio or visual likeness of an individual without the consent of the individual if the likeness was intended to be substantially indistinguishable from the individual and the likeness is used in commercial activity; a political campaign which the individual does not support; a manner intended to make other persons believe that the individual engages in activities the individual would reasonably find offensive; a manner intended to diminish the individual’s credibility, cause embarrassment, or otherwise lower the individual’s esteem within the individual’s community; or a manner intended to induce a person to take an action or divulge information the person otherwise would not. The bill allows a person to bring an action for actual damages and punitive damages for a violation of the bill, plus reasonable attorney fees and costs. Punitive damages cannot exceed $250,000 per violation. The bill allows persons to bring class actions in accordance with the Iowa rules of civil procedure for violations of the bill. The bill requires the court to specify the amount of actual damages, punitive damages, court costs, and reasonable attorney fees for each violation of the new Code chapter. The bill lists several factors a court must consider when determining the amount of punitive damages under the new Code chapter. A device company is considered to have committed a separate violation for each smart device manufactured on or after July 1, 2025, that is initialized in this state. A developer is considered to have committed a separate violation for each smart device that uses the developer’s AI or app on or after July 1, 2025, in this state. A person is considered to have committed a separate violation for each day a likeness is used in violation of the bill. The bill does not preclude a person from bringing an action under any other provision of law.