New Jersey Assembly Bill A5607, introduced October 5, would establish content, data-privacy, and liability requirements for AI chats and chatbot providers. It cleared the Assembly Public Safety and Preparedness Committee on October 19 and now sits in the Appropriations Committee, not yet enacted into law.
Strict Liability, Explained Plainly
Under ordinary negligence law, acting reasonably is a defense; under A5607’s proposed standard, it is not.
Section 4 would classify a chatbot as a product under New Jersey product-liability law. The bill’s proposed language is explicit: “A chatbot provider shall be liable for any injury to a user from the use of its chatbot, even if: (1) the chatbot provider exercised all reasonable care in the design and distribution of the chatbot.”
Liability can also attach when the provider had no direct contractual relationship with the injured user. That means downstream deployments through third-party platforms would not automatically shield the original developer, though that application remains an inference about how courts might interpret the provision.
The Numbers Are Not Small
At $5,000 per violation with no requirement to prove additional harm, the potential exposure compounds quickly.
The attorney general could pursue civil penalties of $5,000 per violation, along with a court order requiring the provider to stop or change the challenged conduct. Users harmed by covered privacy violations could sue in Superior Court for the greater of actual damages or $5,000 per violation, with attorney fees included.
Lawyer Scott S. Christie, as reported by the ABA Journal, assessed the risk plainly: “When there’s $5,000 in statutory damages per violation and you don’t have to prove any harm, in addition to the strict liability standard, you’re talking hundreds of thousands and perhaps millions of dollars per lawsuit.” That is Christie’s legal assessment of potential exposure, not a settled judicial interpretation.
What the Privacy Rules Actually Say
The bill restricts advertising, profiling, and certain training uses of chat data, but it also requires providers to keep those conversations on file.
Providers could not use chat logs for advertising or behavioral profiling, and could not sell a user’s conversation history. The bill also limits specified uses of chat data for AI training and protects users who withhold consent for such uses from retaliation or discrimination.
Chat logs generally could not be retained beyond two years unless law requires otherwise, and users could download their logs at any time. Providers would also need to run monthly risk assessments and maintain a comprehensive data-security program with administrative, technical, and physical safeguards.
A Structural Tension Built Into the Bill
Restricting data exploitation and mandating data retention are goals that pull against each other.
A5607 limits how providers can monetize conversations while simultaneously requiring them to maintain a durable archive of those same conversations. That archive increases exposure in the event of a breach, a subpoena, or litigation discovery, though those consequences are analytical inferences about risk, not findings stated in the bill.
The bill does not expressly require identity verification or continuous conversation monitoring. Even so, the combination of strict liability and broad record-keeping obligations could create incentives for providers to watch users more closely as a risk-management response. Whether that would occur, and to what degree, would depend on later regulations, court interpretations, and individual providers’ decisions.
Where Each Side Stands
Supporters see necessary accountability; critics warn the damages structure invites litigation disconnected from actual harm.
The Electronic Privacy Information Center supports A5607, arguing that major chatbot providers have repeatedly failed to prioritize user safety over profit and should not be left to self-regulate. That is EPIC’s advocacy position, not a neutral finding. Christie, as reported by the ABA Journal, warns that the statutory-damages structure creates outsized litigation exposure. The bill still needs to clear the Appropriations Committee before any floor vote can take place.
