Youth AI Privacy Act

The Youth AI Privacy Act requires companies that provide AI chatbots to minors to implement safety features, limit data use, and ban certain engagement tactics. It also adds privacy protections, whistleblower protections, and directs research and surveys on AI chatbot effects on minors. The Federal Trade Commission (FTC) and state attorneys general enforce the law, and parents can sue violators.

Sec. 3, Definitions: Defines key terms including "AI chatbot" as a natural language interface simulating human interaction, "minor" as under 18, "personal data" broadly, and "deployer" and "developer" as those who make or modify AI chatbots.

Sec. 4, Safe design features: Requires deployers who know a user is a minor to clearly disclose the user is not interacting with a human and content is AI-generated, at the start of each session and every 30 minutes. The FTC must set rules limiting how long a deployer can use a minor's personal data from the current session to generate outputs. The FTC must also ban features that encourage compulsive use, such as rewards for frequency of use, push notifications (except required disclosures), badges, unsolicited outputs, and human-like usage traces like typing bubbles.

Sec. 5, Data privacy protections: Prohibits deployers or developers who know a user is a minor from advertising to them or generating outputs that promote products based on a financial connection. Bans processing personal data for profiling minors. Bans processing or transferring a minor's personal data to train an AI algorithm, except for testing or addressing risks of harm. Also bans processing any input data from a minor except to generate outputs within the allowed session period or for safety testing.

Sec. 6, Whistleblower protections: Prohibits deployers or developers from retaliating against anyone who raises concerns, reports violations, or cooperates in investigations under this Act.

Sec. 7, Research on health effects: Amends existing law to include AI chatbots in research on digital media effects on minors and authorizes $50 million per year from fiscal years 2027 through 2030 for that research.

Sec. 8, Survey inclusion requirement: Requires the Secretary of Health and Human Services to add questions about AI chatbot use (frequency, types, age of first use, perceived impacts, exposure to harmful content) to national health surveys like the Household Pulse Survey and Youth Risk Behavior Surveillance System.

Sec. 9, Enforcement: Treats violations of sections 4, 5, or 6 as FTC-enforceable unfair or deceptive acts. The FTC enforces the Act with its usual powers. State attorneys general can sue on behalf of residents for injunctions, damages, or other relief, after notifying the FTC. Parents or guardians can sue violators of sections 4 or 5 for actual and punitive damages, attorney fees, and injunctive relief. The Act preempts conflicting state laws but allows states to provide greater protections.

Sec. 10, Determining knowledge a user is a minor: For enforcement, the FTC or state attorney general must consider the totality of circumstances to decide if a deployer had implied knowledge a user is a minor. The Act does not require deployers to collect age information or implement age verification. The FTC must issue guidance within 180 days on how it will determine such knowledge, but the guidance is not binding in enforcement actions.