US Senator’s draft legislation targets privacy, safety of AI agents

Sen. Mark Warner released a discussion draft of legislation that would place privacy limits at the center of the emerging market for autonomous AI agents and barring covered systems from using personal data they obtain while acting for consumers for advertising, behavioral profiling, sale, or other secondary commercial purposes.

The restriction would apply to a new category of “custodial user agents” that consumers authorize to act on their behalf online. The agents could still collect, use, or share data when reasonably necessary to perform the service a consumer has delegated, but the proposal would prohibit them from repurposing that access for their own commercial benefit.

Warner also has pressed the Treasury Department to develop clearer rules for agentic AI in financial services where autonomous systems could gain access to bank accounts, payment tools, and other sensitive consumer information.

In a letter to Treasury Secretary Scott Bessent, Warner encouraged the department to “take the necessary steps to develop an understanding of the state of AI agent development, the complete range of use cases and associated benefits and risks, and to develop rules that allow for innovation among financial institutions of all sizes while robustly protecting consumers.”

The Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act would create a federal framework for registered custodial user agents to interact with the country’s largest online platforms on behalf of consumers.

The draft is not a general law governing all AI systems. Instead, it addresses a more specific problem created by agentic AI: how to protect consumers when software is authorized to enter their accounts, access personal data, make purchases, manage settings, post content, or otherwise take actions that can have financial, privacy, and reputational consequences.

Under the draft, a custodial user agent would be a software-based agent expressly authorized by a user to interact with a large online platform on that user’s behalf. The authorization would have to be transparent, documented, limited in scope, and revocable.

“As agentic AI transforms how Americans interact with technology, consumers deserve a real choice in the marketplace – and AI agents must be accountable to the people they serve,” Warner said in announcing the discussion draft. “This discussion draft is a major step toward building a clear federal framework that promotes innovation, protects consumers, and ensures the United States continues to lead the world in emerging technology.”

Warner released the measure for input from stakeholders, experts, and the public before formally introducing legislation.

The draft’s platform-access requirements would apply to online platforms with more than 50 million U.S. customers or subscribers during any calendar month in the preceding 12 months.

The definition includes consumer-facing communications, retail, and information services, such as social media, e-commerce, personal finance, and AI services.

Users would have the right to designate one or more compliant custodial user agents to manage their online interactions, e-commerce decisions, user-generated content, and account settings on the same terms available to the users themselves.

Large online platform providers would be required to maintain transparent, third-party-accessible interfaces through which authorized agents could operate. They could not alter those interfaces or their terms of use for the purpose, or with the substantial effect, of unreasonably blocking or undermining access by authorized agents.

The competition provisions are intended to prevent dominant platforms from using their control over accounts, data, and technical access to steer consumers toward their own agents while shutting out competing services.

The draft would also require a platform that maintains interoperability between its own service and an affiliated custodial-user service to offer competing custodial agents a functionally equivalent interface.

That provision could become especially important if major technology companies build proprietary agents that receive more effective access to platform functions than independent agents acting for consumers.

At the same time, the legislation would not require platforms to admit every automated service that seeks access. A custodial user agent provider would have to register with the Federal Trade Commission (FTC) before an agent it operates or offers could access a covered interface.

The FTC could establish uniform registration terms based on self-attestation.

Within 180 days of registration, the commission or a recognized independent certification body would evaluate the submission. The commission could also establish more specialized terms for agents used in particular commercial settings, considering the privacy, financial security, and personal safety implications of delegated access.

Independent certification bodies could assess whether providers meet standards for conduct, governance, and technical practices.

Certification in good standing would create a rebuttable presumption that an agent provider complies with the draft’s core duties, but it would not create an absolute safe harbor or amount to blanket FTC approval.

The discussion draft creates a registration, certification, and enforcement structure rather than a simple government seal of approval for every AI agent.

Providers could be deregistered for violating the law’s duties, while platforms could deny or revoke access if a provider fails to register, repeatedly facilitates fraud or malicious activity, or continues acting after a user revokes consent.

The proposal’s most consequential provisions are its duties of loyalty, care, and data restraint. A covered agent could not act in a way that benefits itself to a user’s detriment, causes reasonably foreseeable harm, or conflicts with the user’s directions or reasonable expectations.

It also could not collect, use, or share user data obtained while acting for a consumer except as reasonably necessary to provide the delegated service. The draft expressly prohibits using that data for advertising, behavioral profiling, sale, or another secondary commercial purpose.

Those duties could not be waived, limited, or modified through a contract, terms of service, or user consent. The bill also says a consumer’s reasonable expectations must be determined without regard to terms that conflict with those obligations.

The provisions would establish a form of fiduciary like responsibility for agents that gain access to consumer accounts and data. Rather than treating an autonomous agent as just another software tool, the proposal would require it to serve the interests of the person who authorized it.

Agents would also have to maintain real-time records of actions taken on a consumer’s behalf and provide those records to the consumer upon request, except where the consumer had previously directed their deletion.

They could not delegate, assign, or transfer authority granted by a user to another company, agent, or AI system unless the user provided express, specific, and revocable authorization. Any authorized recipient of that delegated authority would be subject to the same duties.

In practical terms, the proposal would require an auditable chain of responsibility when an agent makes a purchase, changes account settings, manages content, accesses financial information, or takes another action with real-world effects.

The draft directs the FTC to establish rules for verifying that an agent’s request for access is legitimate and for giving users a transparent and readily implemented way to revoke prior delegations. The agency would also create complaint procedures for users, platforms, and agent providers.

Platforms could establish privacy and security standards reasonably necessary to protect their systems and user data, but those standards would have to be filed with the FTC and made publicly available.

A platform that denies an agent access under those standards would have to explain its decision to the provider and report the basis of the denial to the commission.

The draft gives denied providers an opportunity to cure deficiencies and permits them to appeal to the FTC. The commission could order access if it concludes that a platform’s denial was arbitrary, capricious, or unsupported by the information submitted.

The National Institute of Standards and Technology (NIST) would have 180 days to identify open protocols, or develop model standards where open protocols do not exist, for making major online services accessible to custodial agents. The standards would cover messaging, social media, e-commerce, personal finance, and AI services.

They would also address limited and revocable delegation credentials, verification of an agent’s identity and registration status, real-time communication of revocations, and the creation of auditable records of actions taken for users.

Warner’s letter to Bessent shows that he sees the issue extending beyond platform competition. Financial services may be among the most consequential settings for agentic AI because systems that can act on behalf of consumers could eventually access payment tools, financial accounts, and sensitive financial records.

The letter calls on Treasury to examine how banks should oversee AI-enabled third-party vendors, how emerging agentic payment rails should be evaluated, and how existing laws allocate liability when agentic systems cause mistakes, fraud, or other losses.

Warner also asked what support and protections consumers would have when an agent makes an error, is manipulated by fraudsters, or otherwise harms a customer while acting for that person.

The letter asks whether Treasury has access to frontier AI models with advanced cyber capabilities for evaluation, testing, and red teaming, and asks how Treasury is coordinating with the federal banking agencies, the Cybersecurity and Infrastructure Security Agency, NIST, the Office of the National Cyber Director and the Intelligence Community to assess the financial sector risks posed by advanced AI models and their agentic capabilities.

Enforcement of the proposed law would rest primarily with the FTC. Violations would be treated as violations of an FTC rule defining an unfair or deceptive act or practice, and the commission would be directed to treat each affected user as an individual violation when assessing a fine.

The FTC would issue implementing regulations in coordination with the Consumer Financial Protection Bureau, the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC).

The FDIC and OCC have regulatory authority over U.S. banks, with the FDIC supervising insured state chartered banks that are not members of the Federal Reserve System and the OCC supervising national banks and federal savings associations.

The proposal preserves existing federal privacy, security, and antitrust laws. It would preempt state law only to the extent that a state requirement conflicts with the federal framework.

That is a significant limitation, as the draft does not impose a broad federal ban on state AI regulation at a time when Congress continues to debate whether Washington should override state laws addressing automated decision making, biometrics, privacy, and consumer protection.

The discussion draft offers one of the clearest federal efforts so far to define what it should mean for an AI agent to act on behalf of a person. Whether it becomes law will depend on whether Congress can resolve difficult questions about registration, technical standards, platform security, access disputes, and how to prevent large technology companies from using security concerns as a pretext for excluding rivals.

Article Topics

AI agents  |  data privacy  |  digital identity  |  legislation  |  U.S. Government