Congress Should Pass AI Law to Reassure the Public

At the dawn of the internet in 1996, Congress adopted Section 230 of the Communications Decency Act (CDA), which generally shields online platforms from liability for content posted by their users. Europe soon followed suit. This deregulatory exemption from normal legal liability is widely considered to have made the creation of the modern internet with its many positive attributes possible. But by immunizing internet platforms it also allowed them to function as sources of disinformation, hate speech, political extremism and mental health risks for the world’s children.

Thirty years later, the reaction has set in. Countries around the world are prohibiting social media companies from offering their services to children. The Court of Justice of the European Union recently carved back legal protections in Europe, ruling that exemption from liability did not apply where an internet service provider uses an algorithm in respect of the information it transmits. Recent US court decisions involving addictive designs and child exploitation have begun to bypass Section 230’s immunity by relying on product liability rules that punish social media companies for defective designs that harm children rather than for the content of their users’ speech.

Lawmakers should not want to repeat this mistake when it comes to AI. Lina Khan, then head of the Federal Trade Commission, said years ago there is no AI exemption from current law, and a useful part of any AI legislation going forward would be a ringing affirmation that AI companies are responsible for the products they produce. It is generally acknowledged that Section 230 does not apply to companies providing generative AI services, since Section 230 protects only user speech, not the content produced in part by AI companies through the models they provide to the public. Despite Section 230, court cases holding AI companies liable for defamation and wrongful death are underway, and one has resulted in a settlement.

But judicial activity and calls for executive branch and/or state AI regulation beg the question of Congress’s role. We posit that Congress is uniquely positioned to reassure the American people that AI will be developed in accordance with existing consumer protection law, as well as protecting the public from catastrophic harms. Therefore, we propose that the US should adopt new laws affirming consumer protection law, as well as ensuring that cybersecurity, bioweapons risk and catastrophic harm are avoided. Focusing these new AI laws narrowly on catastrophic and consumer harm could incentivize broad bipartisan support, leaving for another day or different legislative vehicles other important public policy issues raised by AI including energy usage and possible impact on jobs.

The time to act is now because opposition to AI is growing in the US and because there is a competition between the US, the EU, and China on how best to regulate AI. In fact, a Spring 2025 Pew Research Center Survey found Americans most concerned about AI compared with 24 other countries, and almost half of them had little or no trust in the US government to regulate AI effectively. Moreover, those concerns are not related to political attachment, which is very rare today.

We suggest two separate but complementary paths forward for AI legislation—one narrowly focused on AI frontier models and catastrophic risks and another focused more broadly on algorithmic decision tools and a range of consumer harms.

For example, the approach of national security and catastrophic risk reduction for frontier AI models is embodied in the bipartisan draft AI bill introduced by Congressman Jay Obernolte (R-Calif.) and Congresswoman Lori Trahan (D-Mass.). The proposal directs the Center for AI Standards and Innovation (CAISI) in the Commerce Department to develop voluntary standards and guidelines for frontier AI systems and provides annual appropriations $100 million for testing these systems. It also requires frontier AI developers to write and implement plans addressing risks prior to releasing new models. Like some state bills, it focuses on ensuring that AI models have been developed with “acceptable levels of mitigation of catastrophic risks.”

Senator Ron Wyden (D-Ore.) and Congresswoman Yvette D. Clarke (D-NY) have also reintroduced their Algorithmic Accountability Act. It requires AI model deployers to conduct impact assessments and to attempt to eliminate or mitigate any negative impacts on consumers. A negative impact is defined broadly to include any “likely material negative impact that has legal or similarly significant effects on a consumer’s life.” The bill empowers the Federal Trade Commission to enforce these requirements.

These approaches differ in the range of AI systems they regulate and the harms they seek to prevent, but they are complementary and reinforce each other. In light of the public backlash against AI, Congress should act immediately to move both of them. Congress should also consider tightening up US export control law to ensure that administrations do not act arbitrarily against individual companies, as the administration recently did in an export control order against Anthropic. But the immediate priority should be in avoiding catastrophic harm and reaffirming the applicability of consumer protection law in the AI context.

Would all this be enough to reassure the American public? Probably not. But it would be a start, especially if combined with other measures such as national legislation to protect ratepayers against increases in electricity rates caused by AI data centers, and comprehensive privacy legislation. And because these measures would be laws, not Executive Orders easily rescindable at any time, they should have a useful impact on the public’s willingness to give AI another look.

Congress should make it clear to Americans that AI is not exempt from American consumer protection law. Companies remain responsible for the products they release to the public. Congress should begin its path to AI legislation by saying so.