Source: Holland & Knight

Dataland, presented as the first museum for AI-generated art located in downtown Los Angeles with a debut exhibition titled "Machine Dreams: Rainforest," uses multisensory, emotion‑responsive installations that employ biometric devices, physiological monitoring and environmental sensors. Those systems collect and process information that may fall within the scope of expanding state biometric and privacy laws such as the Illinois Biometric Information Privacy Act (BIPA), the California Consumer Privacy Act (CCPA) and comparable statutes, raising issues about notice, consent, retention, deletion and heightened cybersecurity controls. The project emphasized assembling ecological datasets “always with permission, and through formal partnerships,” reflecting an "ethical AI" trend that favors licensed or institutionally sourced data to address copyright and consent concerns. The article notes more than 140 pending lawsuits challenging whether training generative AI models on copyrighted works without compensation, attribution or consent qualifies as a fair use defense under 17 U.S.C. § 107, and warns that biometric and sensitive data collection expands breach risk and potential regulatory obligations.

Federal legislative proposals described include the CREATOR Act (H.R. 9112), which would create a federal right for visual artists to control commercial exploitation of AI outputs that deliberately impersonate an artist’s style; the NO FAKES Act (S. 4591 / H.R. 8915), which would grant individuals licensable rights against unauthorized digital replicas of name, image, likeness and voice; and the CLEAR (S. 3813) and TRAIN (S. 2455 / H.R. 7209) Acts, which would respectively require training‑data disclosure to the U.S. Copyright Office or create an administrative subpoena process to identify copyrighted works used in model training. The summary reports each bill’s scope and current procedural posture as stated in the text. Recommended governance measures for museums, galleries and partners include auditing privacy and consent practices for immersive experiences, reviewing cybersecurity posture and vendor contracts, documenting permissions and training‑data provenance, updating disclosures for AI-assisted works, and establishing contractual safeguards such as data processing agreements, retention/deletion protocols, breach-notice terms and indemnities. The piece concludes that legal risk in the art market is increasingly driven by how data is collected, processed and governed as AI moves from back-office uses into public cultural experiences, and it advises stakeholders to monitor judicial, legislative and regulatory developments.