Your face. Your voice. Your location, hour by hour, for the last decade. Your medical history inferred from your purchases. Your political beliefs mapped from your reading habits. Your financial vulnerabilities modeled from your search terms. Your children's developing minds profiled before they are old enough to consent to anything. This is not the future. This is today. And none of it is protected by the Constitution of the United States.
The Fourth Amendment protects Americans from unreasonable search and seizure by government agents. It says nothing about the trillion-dollar private surveillance apparatus that has been built, with the full knowledge and partial cooperation of government, in the decades since the internet became the infrastructure of American life. It says nothing about artificial intelligence systems trained on the intimate details of human behavior without consent, compensation, or recourse. It says nothing about the foreign governments and corporations that hold the personal data of hundreds of millions of Americans in servers beyond the reach of American law while remaining entirely within the reach of American markets.
This amendment closes those gaps. It does so not by regulating technology — technology will change faster than any regulation — but by establishing the constitutional principle that personal data is personal property, that digital identity is sovereign, and that no entity — government, corporation, or foreign power — may take, use, or profit from either without the explicit, informed, and revocable consent of the person to whom they belong.
The Fourth Amendment's protection against unreasonable search and seizure was written for a world in which a search required a person to enter another person's space. The Supreme Court has extended it, imperfectly and incrementally, to telephone wiretaps, to the contents of cell phones, to some forms of long-term location tracking. But the third-party doctrine — the legal principle that information you voluntarily share with a third party carries no Fourth Amendment protection — has been the persistent hole through which mass surveillance flows.
When you use a search engine, you share your queries with the search company. When you use a navigation app, you share your location with the map company. When you make a purchase with a payment card, you share your spending with the payment processor, the merchant, and often dozens of data brokers who purchase transaction records. When you speak to a voice assistant, you share your words — and the ambient sounds of your home — with the device manufacturer. Under the third-party doctrine, none of this sharing carries Fourth Amendment protection, because you chose to share it. The fact that you had no practical alternative to sharing it — no meaningful ability to participate in modern American economic and social life without doing so — is legally irrelevant.
Artificial intelligence has made this situation not merely worse but categorically different in kind. The data that you share with dozens of third parties, each of whom held a fragment of your life, can now be aggregated, correlated, and analyzed by AI systems to reconstruct a portrait of your inner life more accurate than any you could produce yourself. AI systems can infer your health conditions from your purchasing patterns, your political beliefs from your social connections, your financial vulnerabilities from your search history, your sexual orientation from your navigation data. The sum of the fragments is not a fragment — it is a person. And that person has no constitutional protection.
The European Union's General Data Protection Regulation, California's Consumer Privacy Act, and the patchwork of state privacy laws that have followed represent genuine attempts to address this problem through legislation. They have failed, not because their principles are wrong, but because they are the wrong instrument. Regulatory frameworks can be lobbied into weakness. They can be outpaced by technological change. They can be undermined by the companies that are supposed to comply with them through consent dialogs designed to confuse rather than inform, through legal language that no ordinary person can parse, and through business models that treat technical compliance as a performance rather than a commitment.
More fundamentally, no state law can protect Americans' data once it has crossed state or national borders. California can regulate what a California company does with California residents' data within California. It cannot regulate what a company headquartered in another country does with that same data once it has been transferred to servers in that country. The data of hundreds of millions of Americans currently resides in jurisdictions whose governments have the legal authority — and in some cases the demonstrated willingness — to access it, weaponize it, and use it against American interests.
Data about a person is an extension of that person. It carries their history, reflects their thoughts, reveals their vulnerabilities, and shapes their opportunities. A person who does not own their data does not fully own themselves. A nation whose citizens' data is held by foreign powers under foreign law is not fully sovereign. These are not metaphors. They are structural facts with structural consequences.
The data privacy problem that existed before artificial intelligence was serious but bounded. A company that held your purchase history could show you targeted advertisements. A government that accessed your email could read what you had written. The harm was real but the scope was limited by the capacity of human analysts to process information.
Artificial intelligence removes that limit. AI systems can process the entire digital history of a person's life — billions of data points spanning years or decades — in seconds, and can extract from that history insights that the person themselves might not consciously possess. AI can predict health outcomes before symptoms appear. It can identify psychological vulnerabilities that can be exploited for manipulation. It can model a person's future behavior with a precision that makes genuine choice — the foundation of democratic self-governance — increasingly theoretical.
AI systems are trained on data. The data they are trained on shapes what they know, what they can do, and whose interests they serve. AI systems trained on data extracted from millions of Americans without consent — which is to say, essentially every major AI system currently in commercial deployment — are not neutral tools. They are instruments built from the unconsented labor of the people they are used upon. The constitutional question is not whether this is harmful, though it is. The constitutional question is whether Americans have a right to control whether their most intimate information — the details of their lives, their health, their beliefs, their relationships — is used to build tools that will be used to influence, manipulate, and profit from them and their children.
The framework for this amendment draws directly from the sovereignty principles developed by Kavanagh Industries in its RigidTrust constitutional architecture — principles forged in the practice of building systems that treat data ownership as a structural fact, not a policy preference. Where the autonomous systems amendment asks how machines must be governed, this amendment asks who owns the most fundamental input to those machines: the data of human lives.
"Data lives where the customer wants it. The platform works either way. Sovereignty is not a feature — it is the foundation."
Personal data must be treated as personal property in the constitutional sense — not as a commodity that a person licenses to a platform by clicking "I agree," but as property that belongs to the person, that cannot be transferred without genuine informed consent, and that generates enforceable rights when taken, used, or exploited without authorization. The legal infrastructure for this already exists in property law. What is missing is the constitutional recognition that personal data falls within it.
The consent paradigm of current data law — the 47-page terms of service, the cookie banner designed to frustrate refusal, the all-or-nothing choice between privacy and access — is not consent. It is coercion dressed in the language of agreement. Constitutional consent for the use of personal data must be specific to the use, plain in language, meaningful in alternative, revocable at any time, and — where the use generates commercial value — compensated. A corporation that profits from a person's data owes that person a share of that profit, because the data is the person's property and the profit was generated from it.
A minor cannot enter a binding contract. A minor cannot consent to a medical procedure. A minor cannot vote, enlist, or purchase alcohol. The law recognizes that the developing mind lacks the capacity for the kind of fully informed, long-term consequential decision that these actions require. The same principle applies, with greater force, to the collection and commercial exploitation of children's personal data. No child's data shall be collected for commercial purposes. No child's behavioral patterns shall be used to train AI systems. No child's digital identity shall be built into a commercial profile before they are old enough to understand or contest it. This protection is absolute and admits no exception for parental consent, because the harms of childhood data exploitation extend into adulthood in ways that neither the child nor the parent can fully anticipate at the time.
Data about an American is American data. The constitutional protections that attach to it do not depend on where it is physically stored. An American's medical records stored on servers in a foreign country are not thereby subject to that country's legal regime to the exclusion of American constitutional protections. The corporation or government that holds that data holds it subject to the constitutional rights of the person to whom it belongs, regardless of where it sits. Foreign entities that derive commercial benefit from American personal data are subject to American constitutional law as a condition of that access. No exception exists for classification, for national security, or for the convenience of global data markets.
Personal data — any information generated by, derived from, or describing the behavior, biology, identity, relationships, beliefs, or activities of an identifiable natural person — is the sovereign property of that person. No government, corporation, or other entity shall collect, store, use, sell, share, or process personal data without the explicit, specific, informed, and revocable consent of the person to whom it belongs, except as provided in Section 6 of this Article.
A person's digital identity — including their face, voice, likeness, biometric data, and any synthetic representation thereof — is an extension of their person and is protected by this Article. No entity shall create, use, distribute, or profit from a synthetic representation of a person's identity, including representations generated by artificial intelligence, without that person's explicit, specific, and compensated consent. A person's digital identity may not be taken, replicated, or weaponized by any entity for any purpose without consent.
Consent under this Article must be:
Affirmatively given in plain language, specific to the purpose and duration of use, not buried in general terms of service, and not implied by continued use of a service.
Withdrawable at any time, with immediate effect, without penalty, and without loss of access to any service or benefit to which the person is otherwise entitled.
Not conditioned on access to commerce, communication, employment, healthcare, housing, education, or any other essential activity of American life. Consent extracted as a condition of necessity is not consent.
Where personal data is used to generate commercial value — including for the training of artificial intelligence systems — the person whose data generates that value is entitled to fair compensation, the terms of which shall be established by Congress.
No artificial intelligence system shall be trained on personal data without the explicit consent of each person whose data is used, as defined in Section 3. This prohibition applies regardless of whether the data was previously made publicly available by the person, and regardless of the stated purpose of the AI system. Prior collection of data under terms that did not specifically contemplate AI training does not constitute consent for that purpose.
No personal data of any person under the age of eighteen shall be collected, stored, used, sold, shared, or processed for any commercial purpose. No artificial intelligence system shall be trained on data generated by or describing persons under eighteen. No entity shall create a commercial behavioral profile of a person under eighteen. Parental consent does not authorize commercial data collection from minors under this Article. This protection is absolute and admits no exception.
No agency, department, or instrumentality of the United States government, or of any state, shall access, collect, or use personal data, or employ artificial intelligence to analyze, aggregate, or draw inferences from personal data, except upon a warrant issued by a court of competent jurisdiction supported by probable cause, specifically describing the data to be accessed and the purpose of access. No warrant shall authorize the bulk collection or analysis of personal data of persons not individually identified as subjects of investigation. The use of artificial intelligence to conduct surveillance or construct predictive profiles of persons based on protected characteristics is prohibited.
Personal data of American citizens and residents is subject to the protections of this Article regardless of where it is physically stored or processed. Any entity that collects, stores, or processes such data — including entities incorporated or operating under the law of foreign governments — does so subject to the rights established by this Article. No foreign entity shall hold personal data of Americans under conditions that permit a foreign government to access that data without complying with the requirements of Section 6. Congress shall establish the mechanism for enforcement of this Section against foreign entities.
Every person shall have the right to: know what personal data any entity holds about them; correct inaccurate personal data; demand the permanent deletion of their personal data from any entity that holds it, with immediate effect; and receive their personal data in a portable format enabling transfer to any other system or service of their choice. No entity shall condition compliance with these rights on any payment, waiver, or consent to additional data collection.
No consequential decision affecting a person's access to credit, employment, housing, healthcare, education, insurance, or government benefits shall be made solely by an automated or artificial intelligence system without: disclosure that the decision was automated; a plain-language explanation of the factors that determined the outcome; and a meaningful right to human review and contestation. The use of personal data as defined in this Article in such systems is subject to all protections of this Article.
Every person has the right to know when they are interacting with an artificial intelligence system rather than a human being, and when content they receive has been generated or significantly modified by artificial intelligence. No entity shall deploy an artificial intelligence system that conceals its nature from the person with whom it interacts. No entity shall use artificial intelligence to generate content designed to deceive a person into believing it originates from a natural person.
Every violation of this Article gives rise to a private right of action in federal court. Congress shall establish a Federal Data Sovereignty Authority empowered to investigate violations, impose civil penalties, and refer criminal violations for prosecution. Tampering with, defeating, or circumventing the consent, deletion, or access mechanisms required by this Article is a federal felony. Strict liability attaches to any entity that collects or uses personal data in violation of this Article.
Congress shall have power to enforce this Article by appropriate legislation, including establishing compensation frameworks under Section 3, enforcement mechanisms under Section 7, and penalties under Section 11.
The technology industry will argue that this amendment destroys the business model of the modern internet and makes American AI development uncompetitive with foreign powers, particularly China, that face no equivalent restrictions. This objection deserves a direct answer: the business model it destroys is one built on taking the property of hundreds of millions of people without payment or consent, and the competitive advantage it surrenders is the ability to do so. An America that competes on AI by treating its citizens' most intimate data as a freely extractable resource is not competing on American values — it is racing to the bottom of a surveillance economy that China built and that no free republic should aspire to match.
The practical concern about AI development is more serious. AI systems require large datasets to train. If American companies cannot train on American data without consent and compensation, will they be outpaced by foreign competitors who face no such restrictions? The answer is that they will be forced to build better systems on smaller, higher-quality, consented datasets — and that consented, compensated data is more accurate, more representative, and more ethically defensible than scraped data. The companies that build on legitimate foundations will build more durable systems. The companies that cannot compete without taking what does not belong to them should not compete.
Section 6's warrant requirement for government AI surveillance will be contested by the national security establishment on the grounds that bulk data collection and AI analysis are essential to identifying threats before they materialize. This is the same argument that was made for the FISA bulk collection programs revealed in 2013, and the independent reviews of those programs consistently found that their effectiveness did not justify their breadth. A constitutional requirement for individualized suspicion before AI-powered surveillance does not prevent the government from investigating known threats. It prevents the government from treating every American as a presumptive subject of surveillance on the theory that some of them might eventually become threats.
The warrant requirement in Section 6 is explicit that it covers AI-powered analysis, not merely data collection. This is essential. A government that cannot constitutionally read every American's mail cannot constitutionally build an AI system that reads every American's digital life and reports the interesting parts. The constitutional principle is the same. The technology changes the scale of the harm, not the nature of the right.
Section 7's assertion of American constitutional jurisdiction over data held by foreign entities will be challenged on the grounds that the United States cannot legislate for the world. This is correct but irrelevant. The United States does not need to legislate for the world. It needs to establish the condition of access to American persons and American markets: entities that wish to hold data about Americans and operate in the American economy do so subject to American constitutional requirements. A foreign company that finds this unacceptable is free to exit the American market. The United States has used this leverage effectively in trade, in taxation, and in financial regulation. It can use it here.
These two amendments are companion documents, not coincidentally. The autonomous systems amendment governs how machines that act in the physical world must be governed. The personal data sovereignty amendment governs the fuel those machines run on. The connection is direct and structural: every autonomous system that operates in the world generates data about the world and the people in it. Every AI system that makes decisions affecting human lives is trained on data about human lives. Without the data sovereignty framework of Amendment XXIX, Amendment XXVIII's requirement for human authority over autonomous systems is incomplete — because the humans who are nominally in authority may themselves be operating on the basis of AI analysis built from data taken without their consent or the consent of the people it describes.
Together, the two amendments establish a constitutional framework for the age of artificial intelligence that is coherent with the founding principles of the republic: that persons have sovereignty over their bodies, their property, and the products of their labor; that government power requires constitutional authorization and meaningful constraint; that the most fundamental rights of Americans cannot be signed away in a terms of service agreement or waived by the passage of a regulation; and that the power of technology must serve the freedom of persons, not the reverse.
"The ONLY path back to TRUE ownership — for your data, for your machines, for your legacy. Sovereignty is not a product feature. It is a constitutional guarantee — or it is nothing."
The question before the American people is not whether artificial intelligence will shape the next century of American life. It will. The question is whether the constitutional architecture that protects American freedom will be extended to meet it — or whether the most powerful surveillance, manipulation, and control technology in human history will be built on a foundation that has no constitutional walls, only policy suggestions that the most powerful actors are already paying lawyers to route around.
The walls must be built now. Before the dependency is total. Before the data is gone. Before the children who are growing up inside this system become adults who have never known what it means to own the record of their own lives.
This paper is the companion document to the Proposed Amendment XXVIII — The Autonomous Systems Sovereignty and Safety Amendment, also published by Kavanagh Industries in April 2026. The sovereignty principles described herein are drawn from the RigidTrust constitutional architecture and the Nine Bills of Rights developed by Kavanagh Industries for sovereign AI and data systems. Both documents may be reproduced freely for the purpose of advancing the legislative and constitutional discussion they describe, with attribution to Kavanagh Industries LLC. The live proof-of-concept case study that grounds both documents is publicly available at kavanaghind.com/three-laws-proof.
Kavanagh Industries · Always on