New Jersey Bill Would Treat AI Chatbots as Products and Impose Strict Liability on Chatbot Providers

New Jersey Assembly Bill A5607 was introduced in the New Jersey General Assembly on Oct. 5, and on Oct. 19, the Assembly Public Safety and Preparedness Committee reported the bill favorably and referred it to the Assembly Appropriations Committee. The bill, which supporters describe as based on a “People-First Chatbot” model bill developed by the Electronic Privacy Information Center (EPIC), the Consumer Federation of America, and Fairplay, would establish content and data privacy requirements for chatbot providers and expressly subject chatbots to product liability claims.

The bill is not yet law, and none of its requirements is currently in effect; the provisions described below reflect the bill as introduced and may change.

Who Would Be Covered

The bill defines an “artificial intelligence chatbot” broadly as any “software application, web interface, or computer program that simulates human conversation and interaction through text, visual images, video, or aural communications.”

A “chatbot provider” is any individual or business entity, including any member, affiliate, subsidiary, or beneficial owner, that “creates, distributes, or otherwise makes available a chatbot.” Because the definition of chatbot provider reaches entities that merely make a chatbot available, it could extend beyond AI developers to businesses that deploy chatbots on their websites or apps, such as customer service assistants. The bill also designates chatbot providers as “controllers” under the New Jersey Data Privacy Act, P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.), which would layer that Act’s controller obligations on top of the bill’s chatbot-specific requirements. Committee discussion also noted a lack of clarity about the bill’s geographic scope.

The bill’s coverage is also notably broader than chatbot laws already enacted and in effect in other states. California’s SB 243 (effective Jan. 1, 2026) and New York’s AI Companion Models Law (General Business Law Article 47, effective Nov. 5, 2025) apply to “companion” chatbots, and SB 243 expressly excludes chatbots used solely for customer service. A5607, as introduced, contains no comparable carve-out for customer service, productivity, or other general-purpose chatbots.

Product Liability and Strict Liability

The bill’s most significant provision would make a chatbot a “product” for purposes of a product liability action. It would also impose on chatbot providers a “duty to ensure that use of their chatbot does not cause injury to a user.”

Under the bill, a chatbot provider would be liable for any injury to a user from use of its chatbot, even if: (1) the provider exercised all reasonable care in the design and distribution of the chatbot, or (2) the provider did not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user. This would create a strict liability standard that does not depend on fault or privity.

This framework, if enacted, would depart significantly from current New Jersey law under the New Jersey Products Liability Act (NJPLA), N.J.S.A. 2A:58C-1 et seq. Although the NJPLA already provides for strict liability, it requires a claimant to prove that the product was not reasonably fit, suitable, or safe for its intended purpose because of a manufacturing defect, a design defect, or inadequate warnings. The NJPLA also provides statutory defenses to design defect claims, including the absence of a practical and technically feasible alternative design. The NJPLA also allows a product seller, in many circumstances, to be relieved of strict liability claims by identifying the manufacturer. A5607, as introduced, would make a provider liable for “any injury” from use of its chatbot and does not expressly address whether proof of a defect is required or whether these NJPLA defenses would remain available.

The bill would also codify a position that courts have only begun to address. In Garcia v. Character Technologies, the U.S. District Court for the Middle District of Florida in May 2025 allowed product liability claims against a companion chatbot developer to proceed, rejecting at the pleading stage the argument that the chatbot was a service rather than a product and declining to hold that its output was protected speech; the case was later dismissed following a settlement in January 2026. That ruling was a pleading-stage decision by a federal trial court applying Florida law and is not binding in New Jersey. Similar claims against OpenAI have been coordinated in San Francisco Superior Court (In re ChatGPT Product Liability Cases, JCCP No. 5431) and remain pending. A5607 would resolve the product question by statute for New Jersey claims, although First Amendment challenges to the provision would remain possible.

Data Privacy and Content Restrictions

As introduced, the bill would prohibit chatbot providers from:

• Using personal data to shape outputs. Processing personal data other than input data to inform chatbot outputs, unless necessary to fulfill a user’s express request and the user has given affirmative consent.
• Advertising based on chat logs. Processing a user’s chat log to decide whether to show an advertisement, what to advertise, or how to customize or present an advertisement.
• Minors and training. Processing chat logs or personal data of users the provider knows or should know are under 13 without the affirmative consent of a parent or legal guardian; using chat logs or personal data for training where the provider knows or should know, based on objective circumstances, that the user is under 18; or using data of adult users for training without prior affirmative consent.
• Profiling, sale, and retention. Profiling, or using personality or behavioral classifications created through profiling, beyond what is necessary to fulfill a user’s express request; selling chat logs; or retaining chat logs for more than two years unless necessary to comply with the bill or otherwise required by law.
• Retaliation. Discriminating or retaliating against users, including by denying services, charging different prices, or providing lower quality services, for declining to consent to the use of their data for training or for accessing their own chat logs.
• Professional impersonation. Advertising or representing that chatbot outputs are provided by, endorsed by, or equivalent to services of a profession or occupation regulated under Title 45, or of the Judicial Branch or the Administrative Office of the Courts. A violation of this prohibition would also be an unlawful practice under the New Jersey Consumer Fraud Act.

Several definitions in the bill would narrow these prohibitions in important ways. “Training” excludes testing to identify risks of harm to users and modifications made to address those risks, “profiling” excludes processing chat logs for user safety or compliance with the bill, and “sell” excludes disclosures to a third party that processes data on the provider’s behalf.

The bill also sets a demanding standard for “affirmative consent.” Consent would have to be requested in a clear and conspicuous standalone disclosure, written in easy-to-understand language, and offered in each language in which the chatbot is provided. The option to refuse would have to be at least as prominent as, and take no more steps than, the option to consent. Consent could not be inferred from inaction or continued use and would not include acceptance of general terms of use or agreement obtained through misleading statements or dark patterns.

Chatbot providers would also have affirmative obligations to post information about their chatbot on their website, allow users to access and download their chat logs in a portable format, maintain and publicly post a written comprehensive data security program with administrative, technical, and physical safeguards, assess their chatbot for risks of harm to users on a monthly basis, and mitigate identified risks. Several of these obligations would be defined further through rules adopted by the New Jersey Attorney General.

Enforcement and Potential Exposure

A chatbot provider found to have allegedly violated the bill would be subject to a civil penalty of $5,000 for each violation, collected in a summary proceeding under the Penalty Enforcement Law of 1999, and the Attorney General could bring a civil action for injunctive relief. Users harmed by violations of the bill’s privacy and operational requirements could sue in the Superior Court of the county in which they reside and recover the greater of actual damages or $5,000 per violation, along with reasonable attorney fees and court costs. Violations of the professional-impersonation prohibition would also be actionable under the Consumer Fraud Act.

Because statutory damages of $5,000 per violation would be available as a floor, regardless of the amount of actual damages, and liability under the product liability provision would not depend on fault, potential exposure could grow quickly where a single practice allegedly affects many users. Defense practitioners have warned that the bill could “open the floodgates” to litigation, noting that a provider violating the statute as to one user is likely doing so as to all users.

The bill states that it would not limit other New Jersey laws and that, in the event of a conflict, the law affording the greatest protection to users would control. If enacted, it would take effect on the first day of the sixth month after enactment, although the Attorney General could take anticipatory implementation steps before then.

Related Pending Legislation and Federal Developments

A5607 is one of several pending New Jersey proposals addressing AI harms. A5090, the “GAI Accountability Act,” was introduced in May 2026 and remains pending in committee. It would impose $20,000-per-violation civil penalties, enforceable by the Attorney General, on generative AI platforms that fail to prevent certain harmful conduct, including endangering the welfare of children, subject to a reasonable-efforts affirmative defense. Consumer and privacy advocates supported A5607 in committee, while the New Jersey Chamber of Commerce, TechNet, and Meta opposed it, with the Chamber arguing that the state’s existing privacy law already addresses some of the bill’s concerns and urging a comprehensive AI framework rather than a patchwork of requirements.

No federal preemption currently applies to A5607 or other state AI laws. Executive Order 14365 (Dec. 11, 2025) created a U.S. Department of Justice task force to challenge state AI laws, and the White House has asked Congress to preempt “unduly burdensome.” But an executive order itself cannot preempt state law, and Congress has not enacted preemption legislation. Whether future federal action would reach a law like A5607 is uncertain.

Takeaways

A5607 remains pending legislation. It has cleared one committee and been referred to the Assembly Appropriations Committee, but it must still pass both houses of the Legislature and be signed by the Governor before it becomes law, and it may change as it moves through the legislative process. Because the bill is not yet law, the steps below are preparatory rather than current compliance obligations, although several of our suggested steps overlap with obligations that may already apply under existing law, such as the New Jersey Data Privacy Act. In the meantime, chatbot providers, including businesses that deploy chatbots built on third-party models, should consider the following steps:

• Inventorying customer-facing chatbots and conversational AI features, including those licensed from vendors, that may be available to New Jersey users.
• Mapping how chat logs and personal data are used, retained, and shared, including for advertising, personalization, profiling, and model training, and comparing retention schedules against the proposed two-year limit.
• Assessing whether existing consent flows would satisfy the bill’s affirmative consent standard, which would not be met by acceptance of general terms of use, continued use, or dark patterns.
• Reviewing age signals and controls in light of the bill’s “knows or should know” standard for minors.
• Reviewing vendor and licensing agreements for indemnification, limitations of liability, insurance requirements, and allocation of compliance responsibilities, since the product liability provision would apply even without a contractual relationship with the user.
• Evaluating insurance coverage for AI-related bodily injury and privacy claims.
• Monitoring amendments to A5607 and the status of related pending bills, including any clarification of geographic scope, the defect requirement, and the bill’s interaction with the NJPLA, as well as federal preemption developments, and considering whether to engage in the legislative process.