New Jersey Targets Chatbots – Lawsuits Coming

New Jersey’s A5607 would make chatbot makers pay for user injuries even if they followed every rule—and it could force more data checks that worry privacy advocates.

Story Highlights

Bill A5607 treats chatbots as products and makes providers liable for user injuries.
The bill limits chat-log retention and restricts training on personal data without consent.
Opponents warn it could trigger broad age checks and clashing data duties.
The fight shows growing push to police risky AI while guarding privacy.

What A5607 Would Change For Chatbots And Liability

New Jersey lawmakers advanced A5607 to answer a basic question: who pays when a chatbot harms a user. The bill says a chatbot counts as a product, and it gives users a path to sue for injuries tied to use of the tool. State analysts write that providers have a duty to make sure use of their chatbot does not injure users, bringing product-liability rules to software that talks like a person. Supporters say this will push safer design and faster fixes.

The bill’s text and related summaries describe a tougher standard that does not turn on proving a careless design. Coverage notes that providers could face claims even when they used reasonable care in building and shipping the system. That approach mirrors how the law treats many consumer goods. Backers argue that chatbots can shape health, money, and legal choices, so the costs of risk should fall on companies, not families already stretched by rising prices and service failures.

Privacy Guardrails: Consent, Retention Limits, And Access

A5607 also draws hard lines on data use. The introduced text would limit keeping chat logs to two years, ban selling chat logs, and restrict using personal data and chat logs for model training without clear, prior user consent. The committee version adds monthly risk reviews and mitigation steps set by the Attorney General’s rules. An outside legal analysis says providers would need adult users’ affirmative consent to train on their chats, and should not train on the data of users they know or should know are minors.

These guardrails aim to reduce surprise data grabs and ad targeting. They also try to slow the quiet spread of sensitive life details. Privacy lawyers warn that chat sessions often include health concerns, sexual topics, family conflict, debt stress, work problems, location, identity, and even emotional history. In short, these are not throwaway texts. The bill’s limits speak to a broad mistrust many Americans share: that tech firms collect first, explain later, and answer only when caught.

Opposition: Age Checks, Conflicting Duties, And Compliance Burden

Industry critics warn the bill could backfire on privacy. The Chamber of Progress argues that the “should have known” standard for minors could push providers to verify every user’s age, which means more identity checks and more friction at sign-up. The group also flags a clash: a two-year cap on chat-log retention versus a duty to let users access and download logs “at any time,” which could force longer storage or complex archiving to meet both commands.

A widely used sepsis model missed 67% of sepsis cases when tested outside the lab that built it. Now federal AI transparency rules are leaving EHR certification.

Your contract is the last line of defense. https://t.co/1AMXX35Xdx

— Will Conaway (@WillConaway1) November 2, 2026

Opponents further point to new monthly risk assessments and security program duties that would begin before the Attorney General sets the metrics, risking confusion and cost with rules that are still coming into focus. Small and mid-size firms could struggle most. That raises a fairness question both left and right ask often: do rules crush upstarts while giants hire more lawyers? If so, power concentrates, and users get fewer choices and weaker leverage over their own data.

Why This Fight Matters Beyond New Jersey

New Jersey’s move fits a national turn from soft “AI principles” to real enforcement. The Federal Trade Commission has already acted when companies hyped AI or shipped risky tools that failed to protect people, including a proposed settlement over claims that an app could replace a licensed lawyer. A5607 tests a bolder idea: treat deployment itself as a source of legal risk and let courts, not only agencies, sort out injuries and costs. That could reshape incentives across finance, health, and customer service.

But the privacy tradeoffs are real. Analysts warn that records shared with one regulator can be pulled by another during probes, which could include customer chatbot transcripts. That risk feels familiar to many Americans who think the system serves insiders first. Voters across parties want safer tech and real accountability. They also want less tracking, fewer hoops, and simple rights they can use. A5607 forces the hard balance: accountability without turning chat into a new surveillance pipe.

What To Watch Next: Rules, Lawsuits, And Real-World Impact

Next steps hinge on the Attorney General’s rules, which will set the monthly risk metrics and mitigation duties. Clear, narrow rules could reduce confusion and lower compliance costs. Courts will likely test how far “product” liability reaches for software that updates often. Users should watch for changes in sign-up flows, age checks, and new consent prompts, as providers adapt to the bill’s training and retention rules. Expect larger firms to move first, and smaller ones to weigh exit or pared-down features.

For citizens, the core tradeoff is simple. Stronger liability can reduce harm and curb hype. Stronger privacy can keep your life out of corporate and government files. But overbroad duties can lock in big players and spur more data collection “just to be safe.” New Jersey is trying to thread that needle. Whether it succeeds will tell us if states can defend people without handing more power to the very gatekeepers many feel have already failed them.