As artificial intelligence continues to advance and its role increases in commerce, education, communication and countless other aspects of daily life in our society, legislation introduced with the important aim of providing consumer and other personal protections is being debated in state capitals throughout our country.
Our chambers support well-designed regulation that provides meaningful protections, while allowing continued innovation. Accordingly, we agree with Delaware House Bill 306’s goal of putting in place safeguards to ensure that chatbots and other AI technology are used responsibly and that consumer and other personal protections are sufficient to ensure the highest and best use of this transformative technology. However, we respectfully submit that the legislation requires amending to further those goals, while providing legal and regulatory certainty for both businesses and consumers.
To address the need for sound consumer and personal protections without stifling innovation or creating unintended consequences, House Bill 306 is in need of substantial amendment.
In its current form (as passed by the House of Representatives), the bill creates significant litigation risk for many entities, from small businesses to large companies. There remain substantial questions on the part of the business community as to what would constitute sufficient compliance to avoid expensive litigation. The bill currently creates a private right of action, authorizes statutory damages of at least $1,000, allows class-action exposure up to $10 million and permits civil penalties of up to $5 million, with each interactive session treated as a separate violation.
Legal experts widely agree that this legislation, as written, does not require plaintiffs to prove actual harm before bringing claims. Instead, it opens the door to lawsuits, even in situations in which a business has acted in good faith to comply but inadvertently falls short of the statute’s requirements — regardless of whether any individual or group has suffered real harm.
Based on the considerable litigation we’ve witnessed in the areas of patent litigation and expensive claims arising from the Digital Millennium Copyright Act, we are concerned that this legislation, without clarifying amendments and sufficient guardrails, could lead to claims against businesses and nonprofit organizations on a similar scale. For a large company, that is a concern; for a small- or midsize business, such claims could prove financially devastating.
There is already a model in place in Delaware to allow enforcement and remedies where actual harm has occurred.
By contrast, the Delaware Personal Data Privacy Act expressly provides that nothing in the chapter creates a private right of action and places enforcement with the Department of Justice. Delaware’s consumer fraud law prohibits deception and concealment when done “with (the) intent that others rely” on the misrepresentation or omission. And the deceptive-trade practices statute allows civil penalties only for “wilful” violations. Those differences matter. They reflect a long-standing policy judgment that serious liability should generally be tied to intent, harm or public enforcement — not mere technical noncompliance.
The practical consequences of laws like HB 306 are easy to foresee: Businesses will hesitate before deploying beneficial AI tools at all. Chatbots can help small companies extend customer service beyond business hours, reduce wait times and answer routine questions efficiently. Banks, retailers, health providers and community businesses are experimenting with these tools because they can improve service and lower costs. A law that threatens crushing penalties without requiring proof of deception or injury will not just punish bad actors; it will discourage good-faith adoption across the board.
There are solutions that would result in a bill that provides meaningful protections to the public, while also allowing businesses and nonprofits to adopt new technologies with confidence.
Amending language provisions to 1.) require a showing of actual harm to successfully bring a claim; 2.) mirror the existing provisions in the Delaware Personal Data Privacy Act that place enforcement in the capable hands of the Delaware Department of Justice, rather than creating class-action litigation exposure and a private right of action; and 3.) improve safe harbor language that would clarify what constitutes good-faith compliance, which would go a long way toward meeting the aims of the legislation without unintended consequences for Delaware businesses and other organizations.
In closing, while we commend the sponsor for her interest in protecting the public and in ensuring the responsible use of chatbots and related AI technologies, we cannot support the bill in its current form. As such, we respectfully, but emphatically, recommend that the legislation be amended to provide clarity, address uncertainty regarding good-faith compliance and mitigate the substantial and unintended liability for businesses and nonprofits who will be seeking to act, in good faith, to meet the requirements of the resulting statute. We ask the Delaware Senate to vote no on HB 306 in its current form.
Reader reactions, pro or con, are welcomed at civiltalk@iniusa.org.
