CHATBOT Act

This bill requires companies that primarily provide AI chatbots to create family accounts for children under 13 and obtain verifiable parental consent for teens aged 13 to 17 before they can use the chatbot. It also bans targeted advertising to children and teens, sets default privacy and safety controls, and mandates studies on the impact of AI chatbots on youth.

Sec. 2, Definitions: Defines key terms including 'artificial intelligence chatbot' as an AI that engages in open-ended conversations, 'child' as under 13, 'teen' as 13 to 17, 'covered entity' as a website or app whose primary function is providing such a chatbot, and 'transparency label' as a notice that the chatbot is AI.

Sec. 3, Family account requirement for children; termination of existing user accounts and profiles; deletion of personal data: A covered entity must require a child to create a family account to access the chatbot. Existing accounts of children without a family account and teen accounts without parental consent must be terminated, and personal data deleted, with a 90-day window for the user or parent to request a copy of that data.

Sec. 4, Verifiable parental consent and option for family accounts for teens: Before a teen creates an account, the covered entity must notify the parent and get verifiable parental consent. The parent must be given the option to create a family account for the teen. If no family account is created, default protective settings apply. Parents can later revoke consent, which disables the teen's account.

Sec. 5, Parental controls and settings for family accounts: A family account must let the parent control privacy and account settings, such as limiting time, disabling rewards, notifications, financial transactions, and unsolicited outputs, and setting transparency label intervals. Parents can access full conversation records and receive alerts if controls are bypassed. Default settings must be the most protective, and parents can choose pre-set tiered options.

Sec. 6, Prohibition on targeted advertising: A covered entity cannot use personal data of a child or teen for targeted advertising. However, age-appropriate advertising based only on the user's age is allowed.

Sec. 7, Determination of whether a covered entity knows that an individual is a child or teen: Whether a covered entity 'knows' a user is a child or teen is based on the totality of circumstances. The bill does not require age gating or affirmative collection of age data. Any voluntarily collected age data must be used only for compliance and retained only as long as necessary.

Sec. 8, Enforcement: The Federal Trade Commission (FTC) will enforce violations as unfair or deceptive acts. State attorneys general can also sue for violations of sections 3 or 4, with notice to the FTC, and the FTC can intervene. A state cannot sue if the FTC is already pursuing an action for the same violation.

Sec. 9, Relationship to other laws: This bill preempts conflicting state laws but allows states to provide greater protections for children. It does not affect the Family Educational Rights and Privacy Act or the Children's Online Privacy Protection Act.

Sec. 10, Study on the impact of artificial intelligence chatbots on child and teen human relationships and social needs: Within two years, the National Science Foundation must study how AI chatbots affect children's and teens' social engagement, mental health, sycophantic behavior, and design features, and report to Congress.

Sec. 11, GAO report on recommendations and best practices: Within two years after the effective date, the Government Accountability Office must report on the act's effectiveness, family account adoption, compliance, parental control effectiveness, and recommendations for parents, the FTC, and Congress, consulting with experts and stakeholders.

Sec. 12, Effective date: The act takes effect one year after enactment.