AI AGENT Act of 2026

This bill, the AI AGENT Act of 2026, aims to promote competition and reduce consumer switching costs in online services by giving users the right to delegate control of their online interactions to third-party software agents (custodial user agents) and requiring large online platforms to provide nondiscriminatory access interfaces for such agents.

Sec. 2, Definitions: Defines key terms including 'artificial intelligence,' 'custodial user agent' (a software agent authorized by a user to interact with a large online platform on their behalf), 'large online platform' (a platform with over 50 million U.S. customers or subscribers per month), 'social graph data,' and 'user data.'

Sec. 3, Delegatability: Grants each end user of a large online platform the right to designate one or more custodial user agents to manage their online interactions, e-commerce decisions, content, and account settings on the same terms as the user. Large online platform providers must maintain transparent third-party-accessible interfaces for this delegation. The FTC must establish authentication rules within 180 days. Custodial user agent providers must register with the FTC, which can set terms of service and recognize independent certification bodies. The FTC can deregister providers that violate duties. Large online platforms may revoke access for unregistered agents or those facilitating fraud. Custodial user agents must safeguard user data, act in the user's interest, avoid secondary data use, maintain records, and not delegate authority without user consent. Large online platforms must provide fair, reasonable, and nondiscriminatory access, with reasonable fees and usage limits proportional to cost. They must disclose interface documentation and provide advance notice of changes.

Sec. 4, Implementation and Enforcement: The FTC, with other agencies, must issue regulations within one year. The FTC must establish authentication rules within 180 days. NIST must identify or develop open protocols for online messaging, social media, e-commerce, personal finance, AI, and verifiable delegation. The FTC will assess compliance, handle complaints, and enforce violations as unfair or deceptive acts under the FTC Act, with fines per affected user. An interagency working group will address harms from fraud or misuse. The Act preempts inconsistent state laws and takes effect upon FTC regulations or one year after enactment.

Sec. 5, Relation to Other Laws: The Act does not modify, limit, or supersede existing privacy and security laws (e.g., Privacy Act, HIPAA, COPPA) or antitrust laws.