S4407-119

What This Bill Does

The CHATBOT Act creates federal rules for public-facing websites, online services, and software applications whose primary function is providing an artificial-intelligence chatbot. The bill defines covered chatbots as open-ended natural-language or multimodal AI systems that accept user input, engage in interactive conversations, and produce outputs that are not scripted, not limited to narrow business or productivity purposes, and not primarily educational. It defines children as users under 13, teens as users ages 13 through 17, personal data by reference to COPPA, targeted advertising, transparency labels, users, parents, covered entities, and the Federal Trade Commission.

If a covered entity knows a user is a child, the child must use a family account meeting section 5 requirements to access the AI chatbot. Existing child accounts must be terminated if the child has not created a family account, and existing teen accounts must be terminated if the parent has not provided verifiable parental consent. When an account is terminated, the covered entity must immediately delete personal data collected from or submitted by the user, including parent-submitted data, except for a termination record and minimum compliance information. For 90 days after termination, the entity must make a readable and portable copy of the personal data available to the user or parent on request when technically feasible and not barred by licensing agreements.

Before a teen creates an AI-chatbot account, a covered entity that knows the user is a teen must directly notify a parent and obtain verifiable parental consent. The parent must be offered the option to create a family account. If no family account is created, the covered entity must fix the teen account's section 5 controls at the most protective default settings until the parent creates a family account and adjusts them. A covered entity is deemed compliant if it satisfies COPPA's direct-notice and verifiable-parental-consent requirements, and it must let parents revoke consent. After revocation, the entity must suspend, delete, or disable the teen account. The bill does not require government-issued ID for relationship verification or parental consent.

Family accounts must let parents set privacy and account controls, limit use time, disable rewards and incentives, disable notifications and push alerts, disable financial transactions, disable AI outputs not responding to user input, require transparency labels, control how long inputs and personal data remain in chatbot memory, access a full conversation and activity record, use monitoring and analysis features, and receive alerts when a minor tries to bypass controls. Default family-account settings must use the most protective option, and covered entities must offer tiered preset choices balancing protection and chatbot effectiveness. They must clearly disclose the scope of each setting, explain family-account policies and management before account creation, and provide accessible reporting and contact channels for control violations or minor-use issues.

The bill prohibits covered entities from using personal data of known child or teen users for targeted advertising. It still allows age-appropriate advertising or marketing if the entity knows the user's age, the ad complies with the targeted-ad ban, and no personal information other than age is used to display it. For determining whether an entity knows a user is a child or teen, the FTC or a state attorney general must rely on competent and reliable evidence under the totality of circumstances. The bill does not require age gates, age verification, or affirmative age-data collection. If a covered entity voluntarily collects data solely for compliance, it may use the data only for compliance and may retain it only as long as necessary for compliance or minimally necessary to demonstrate compliance.

Violations are treated as violations of an FTC unfair-or-deceptive-act rule, enforceable by the FTC with the FTC Act's powers, penalties, privileges, and immunities. State attorneys general may bring parens patriae civil actions for section 3 or 4 violations affecting state residents, after notice to the FTC where feasible. The FTC may intervene, be heard, and appeal. State attorneys general retain investigative powers, but states may not bring a separate action against a defendant while an FTC action against that defendant is pending for the same violation. The bill preempts conflicting state laws only to the extent of conflict, preserves stronger state child protections, and does not affect FERPA, student privacy laws, COPPA, or COPPA rules. The Act takes effect one year after enactment.

The National Science Foundation must conduct or commission, within two years, a study on AI chatbot effects on human relationships and social needs of children and teens, including companionship use, effects on real-world social engagement and mental health, sycophantic or overly affirming chatbot behavior, and design features shaping those outcomes. The Director must report findings to Senate and House committees within one year after enactment. The Comptroller General must submit a report not later than two years after the effective date on the Act's effectiveness, family-account adoption, covered-entity compliance, parental-control effectiveness, model drift, recommended protective settings, best practices for parents, FTC enforcement improvements, and potential legislative improvements, after consulting NIST, the FTC, covered entities, parents, child-safety advocates, AI experts, academic experts, and relevant federal agencies.

Who Benefits and How

Minor chatbot users benefit from mandatory family-account controls, parental consent for teen accounts, protective defaults, data deletion, portable data access after termination, restrictions on targeted ads, limits on compliance data retention, and federal enforcement. Parents of minor chatbot users benefit from consent rights, revocation rights, control over time limits and settings, conversation records, monitoring tools, bypass alerts, and reporting channels. State residents benefit from FTC enforcement and state attorney general actions for family-account or teen-consent violations. Congress, the FTC, NIST, and NSF benefit from studies and reports that identify enforcement gaps, model drift, compliance rates, and best practices.

Who Bears the Burden and How

Covered AI chatbot providers bear compliance burdens because they must define eligible users, create family-account systems, terminate accounts, delete and export personal data, obtain teen parental consent, implement revocation workflows, provide protective default controls, disclose settings, operate reporting channels, limit targeted ads, restrict voluntary compliance data use, and face FTC or state enforcement. AI chatbot advertising businesses lose some ability to target minors using personal data. The FTC and state attorneys general bear enforcement and coordination burdens. The National Science Foundation and Comptroller General bear study and reporting duties, and NIST and other experts may be consulted for the GAO report.

Key Provisions

• Defines artificial-intelligence chatbots, covered entities, children, teens, personal data, targeted advertising, transparency labels, and covered users.
• Requires family accounts for known child users, termination of noncompliant child or teen accounts, immediate data deletion, and 90-day portable data access after termination.
• Requires direct parental notice and verifiable parental consent before known teen users create accounts, with family-account options and revocation rights.
• Establishes parental controls for time limits, rewards, notifications, financial transactions, proactive AI outputs, transparency labels, chatbot memory, records, monitoring, bypass alerts, disclosures, and reporting channels.
• Prohibits targeted advertising using personal data of known child or teen users while allowing age-appropriate advertising based only on age.
• Limits age-verification obligations and restricts use or retention of personal data voluntarily collected for compliance.
• Authorizes FTC enforcement and state attorney general civil actions for section 3 or 4 violations, with FTC notice and intervention rights.
• Preserves stronger state child protections, FERPA, student privacy laws, COPPA, and COPPA rules while preempting only conflicting state rules.
• Directs NSF and GAO to study chatbot social effects, family-account effectiveness, model drift, compliance, enforcement, and legislative improvements.