Youth AI Privacy Act

This Act may be cited as the “Youth AI Privacy Act”.

Congress finds the following:

(1) Millions of teenagers are using artificial intelligence (referred to in this section as “AI”) chatbots for personal, sensitive conversations, disclosing intimate details about their lives, relying on AI chatbots for advice, and developing deep emotional bonds with AI chatbots.

(2) In 2025, approximately 2/3 of teenagers reported using AI chatbots, and roughly 1/4 reported using them daily. 1/3 of teens have chosen to speak with AI chatbot “companions” over a real human for a serious conversation. In a couple tragic cases, a teenager died by suicide after encouragement or advice from an AI chatbot.

(3) Although compulsive use of AI chatbots may pose risks for all users, users who are minors, whose cognitive, emotional, and social capabilities are still developing, are especially likely to misunderstand that an AI chatbot is not a real human and disclose sensitive personal information to the AI chatbot or turn to the AI chatbot for social companionship. Minors are also more susceptible to addictive design features, anthropomorphized systems, and potentially harmful outputs generated by AI systems.

(4) AI chatbot companies are employing manipulative engagement features to keep users engaged on their platforms, including high-frequency push notifications, unprompted AI chatbot responses, typing bubble indicators, and more. These features create serious risks of emotional dependency and compulsive use among minors.

(5) AI chatbots mimic human-like conversations by employing profiling tactics to personalize outputs for users. AI chatbots are also often designed to resemble direct messaging user interfaces. These personalization strategies and anthropomorphic design features can easily confuse users, especially minors, who may believe they are interacting with a real person rather than AI.

(6) Advertisements delivered through AI chatbots may be woven directly into responses or may subtly steer users toward certain products based on how the model was trained. This advertising would be far more covert and harder to recognize than traditional digital advertising, especially for minors. As highlighted by the Commission, many young users lack the skills or cognitive defenses needed to identify such covert or “blurred” advertising.

(7) Extended, multiturn conversations with AI chatbots degrade safeguards against harmful conversational patterns, increasing the likelihood of minors receiving harmful outputs generated by AI systems.

(8) AI chatbots introduce new privacy risks, as they often retain user inputs and personal data to personalize responses and to train the underlying large language models. This practice creates the potential for serious privacy violations, particularly when companies retain and process highly sensitive information from minors.

(9) Congress has a responsibility to address the novel risks posed by AI chatbots and protect minors from potential harm related to anthropomorphism, prolonged engagement, deceptive advertising, and invasive privacy practices.

In this Act:

(1) AI chatbot.— The term AI chatbot means a natural language interface that uses a covered algorithm to provide adaptive responses to user inputs via text, audio, image, video, or any other mode of communication, simulating interpersonal interaction with a user.

(2) Collect.— The term collect means, with respect to personal data, to buy, rent, gather, obtain, receive, access, or otherwise acquire the personal data by any means.

(3) Commission.— The term Commission means the Federal Trade Commission.

(4) Covered algorithm.— The term covered algorithm means a computational process derived from machine learning, natural language processing, neural networks, or other technology of similar or greater complexity.

(5) Deployer.—

(A) In general.— The term deployer means any person that owns, operates, or otherwise makes available to users an AI chatbot in or affecting interstate commerce.

(B) Rule of construction.— The terms deployer and developer shall not be interpreted to be mutually exclusive.

(6) Derived data.— The term derived data means data that is created by the derivation of information, other data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information.

(7) Developer.—

(A) In general.— The term developer means any person that designs, codes, produces, or substantially modifies a covered algorithm for use in an AI chatbot.

(B) Rule of construction.— The terms developer and deployer shall not be interpreted to be mutually exclusive.

(8) Input data.— The term input data means, with respect to an AI chatbot, all information, including text, photos, audio, video, or files, provided to the AI chatbot by a user of such AI chatbot.

(9) Knowledge.— The term knowledge means actual knowledge or knowledge fairly implied on the basis of objective circumstances.

(10) Minor.— The term minor means an individual who is under the age of 18.

(11) Output.— The term output means, with respect to an AI chatbot, any information, including any text, photo, audio recording, video, or file, provided by such AI chatbot to a user.

(12) Personal data.— The term personal data—

(A) means information, including input data, derived data, inferences, or unique identifiers, that identifies or is linked, or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked, or reasonably linkable, to 1 or more individuals; and

(B) does not include publicly available information.

(13) Profiling.— The term profiling means processing data for the purpose of detecting and classifying or designating personality and behavioral characteristics of a user of an AI chatbot.

(14) Process.— The term process means, with respect to personal data, any operation or set of operations performed on the personal data, including analyzing, organizing, structuring, using, modifying, or otherwise handling such data.

(15) Publicly available information.—

(A) In general.— The term publicly available information—

(i) means any information that a deployer has a reasonable basis to believe has been made available to the general public by—

(I) Federal, State, or local government records;

(II) widely distributed media;

(III) a website or online service made available to any member of the public, for free or for a fee, including a website or online service that any member of the public can log into; or

(IV) a disclosure to the general public that is required under Federal, State, or local law; and

(ii) does not include—

(I) any obscene visual depiction (as such term is used in section 1460 of title 18, United States Code);

(II) biometric information;

(III) genetic information, unless made publicly available by the individual to whom the information pertains by a means described in subclause (II) or (III) of clause (i);

(IV) personal data that is created through the combination of personal data with publicly available information;

(V) intimate images that are authentic or computer-generated, known to be nonconsensual; or

(VI) personal data made available by a data broker.

(B) Clarification.— For purposes of this paragraph, information from a website or online service is not available to any member of the public if the individual to whom the information pertains has restricted the information to a specific audience or maintained a default setting that restricts the information to a specific audience.

(16) Transfer.— The term transfer means, with respect to personal data, to disclose, release, share disseminate, make available, sell, rent, or license the personal data (orally, in writing, electronically, or by any other means).

(17) Widely distributed media.— The term widely distributed media—

(A) means information that is available to the general public, including information from a telephone book or online directory, a television, internet, or radio program, the news media, or an internet site, that is available to the general public on an unrestricted basis; and

(B) does not include an obscene visual depiction (as such term is used in section 1460 of title 18, United States Code).

(a) Required disclosures.—

(1) In general.— A deployer with knowledge that a user of an AI chatbot is a minor shall disclose that—

(A) the user is not interacting with a human; and

(B) any content provided by the AI chatbot is generated by artificial intelligence.

(2) Content and duration of disclosure.— A disclosure made by a deployer pursuant to paragraph (1) shall—

(A) be stated in clear, plain, and easy-to-understand language suited to the age of minors likely to access the AI chatbot;

(B) occur at the beginning of every session (as defined by the Commission);

(C) reoccur not less than once every 30 minutes during a session (as so defined); and

(D) be appropriate for the medium of the content, as determined by the Commission.

(b) Limitation on the processing of personal data To provide outputs.—

(1) In general.— Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer with knowledge that a user of an AI chatbot is a minor from processing any personal data of the user to generate, personalize, or otherwise affect an output provided to such user, unless the personal data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under paragraph (2).

(2) Maximum permitted period of use.— In promulgating the regulations described in paragraph (1), the Commission shall determine a maximum permitted period of use during which a deployer with knowledge that a user of an AI chatbot is a minor may collect personal data from such a user and process such data to generate, personalize, or otherwise affect an output (as defined by the Commission) provided to such user during a current session (as defined by the Commission).

(c) Exclusion of features that encourage compulsive use.— Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer or developer with knowledge that a user of an AI chatbot is a minor from configuring such AI chatbot to include, with respect to such user, the following features:

(1) Any reward or incentive based on the frequency of use, time spent, or activity using the AI chatbot.

(2) Notifications and push alerts, other than a disclosure required by subsection (a).

(3) Any badge or other visual award symbol based on the frequency of use, time spent, or activity using the AI chatbot.

(4) Generation of an output absent a user-initiated input or any form of solicitation of engagement from a user.

(5) Usage traces that mimic social interactions with a human, such as typing bubbles or indicators showing that the AI chatbot is available or online.

(a) Prohibition on advertising and promotion.— A deployer or developer with knowledge that a user of an AI chatbot is a minor shall not configure or modify an AI chatbot to—

(1) advertise to such user; or

(2) generate an output that promotes, markets, recommends, or endorses a product or service to such user if the weight or credibility of such promotion, marketing, recommendation, or endorsement is materially affected by a financial connection between the deployer or developer and the seller of such product or service.

(b) Prohibition on processing of personal data for profiling.— A deployer with knowledge that a user of an AI chatbot is a minor shall not process any personal data of the user to engage in any profiling of such user.

(c) Prohibition on the processing or transferring of personal data To train a covered algorithm.—

(1) In general.— Except as provided in paragraph (2), a deployer with knowledge that a user of an AI chatbot is a minor shall not—

(A) process the personal data of such minor for the purpose of training a covered algorithm; or

(B) transfer the personal data of such minor to a third party for the purpose of training a covered algorithm.

(2) Exceptions.— A deployer with knowledge that a user of an AI chatbot is a minor may process personal data of such minor for the express purpose of—

(A) testing and identifying risks of harm to users; or

(B) addressing identified risks of harm to users.

(d) Prohibition on processing of input data.— Beginning on the date that is 30 days after the Commission promulgates regulations under section 4(b)(1), a deployer with knowledge that a user of an AI chatbot is a minor shall not process any input data provided to such AI chatbot by such user for any purpose, other than for the express purpose of—

(1) generating, personalizing, or affecting an output provided to such user when the input data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under section 4(b)(2);

(2) testing and identifying risks of harm to users; or

(3) addressing identified risks of harm to users.

A deployer or developer may not, directly or indirectly, discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against an individual for raising a concern regarding a violation of this Act, reporting or attempting to report a violation of this Act, or cooperating in any investigation or enforcement proceeding pursuant to this Act.

Section 1432 of the Restoring Hope for Mental Health and Well-Being Act of 2022 (42 U.S.C. 285g–11) is amended—

(1) in subsection (a), by inserting, “AI chatbots,” after “augmented reality,”; and

(2) by adding at the end the following:

“(e) Authorization of appropriations.— To carry out this section, there are authorized to be appropriated $50,000,000 for each of fiscal years 2027 through 2030.”.

The Secretary of Health and Human Services, acting through the Director of the Centers for Disease Control and Prevention and in coordination with the Director of the National Institutes of Health, shall incorporate questions related to the use, by youth and by adults, of AI chatbots into national health and behavioral surveys conducted by the Department of Health and Human Services, including the Household Pulse Survey and the Youth Risk Behavior Surveillance System of the Centers for Disease Control and Prevention, including questions designed to capture the following:

(1) Frequency and duration of AI chatbot uses.

(2) Types of AI chatbots accessed, such as AI chatbots designed for mental health, educational, or entertainment purposes or general purpose AI chatbots that are engaged for such purposes.

(3) Age of first use of, and primary contexts of engagement with, AI chatbots.

(4) Emotional, psychological, or behavioral impacts perceived by users of AI chatbots.

(5) Exposure to content that the user perceives to be harmful or inappropriate.

(a) Enforcement by the Commission.—

(1) Unfair or deceptive acts or practices.— A violation of section 4, 5, or 6, or a regulation promulgated thereunder, shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

(2) Powers of the Commission.—

(A) In general.— The Commission shall enforce sections 4, 5, and 6 and any regulation promulgated thereunder in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

(B) Privileges and immunities.— Any deployer or developer that violates section 4, 5, or 6, or a regulation promulgated thereunder, shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

(C) Authority preserved.— Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

(D) Rulemaking.— In addition to the specific rulemaking requirements described in section 4, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.

(b) Enforcement by States.—

(1) Authorization.— In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any deployer or developer in an act or practice that violates section 4, 5, or 6, or a regulation promulgated thereunder, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(A) enjoin such act or practice;

(B) enforce compliance with section 4, 5 or 6, or a regulation promulgated thereunder;

(C) obtain damages, restitution, or other compensation on behalf of residents of the State; or

(D) obtain such other relief as the court may consider to be appropriate.

(2) Rights of the Commission.—

(A) Notice to the Commission.—

(i) In general.— Except as provided in clause (iii), before initiating a civil action under paragraph (1), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring such civil action.

(ii) Contents.— The notification required to be filed by clause (i) shall include a copy of the complaint to be filed to initiate the civil action.

(iii) Exception.— If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.

(B) Intervention by the Commission.— Upon receiving the notice required by subparagraph (A), the Commission may intervene in the civil action and, upon intervening—

(i) be heard on all matters arising in the civil action; and

(ii) file petitions for appeal of a decision in the civil action.

(C) Preemptive action by the Commission.— If the Commission has instituted a civil action for a violation of subsection (a), no State officer may bring an action under paragraph (1) during the pendency of that action against any defendant named in the complaint of the Commission for any violation of subsection (a) alleged in the complaint.

(3) Investigatory powers.— Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.

(4) Venue; service of process.—

(A) Venue.— Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

(B) Service of process.— In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

(c) Private right of action.—

(1) In general.— Any parent or legal guardian of a minor may bring a civil action in any court of competent jurisdiction against a deployer or developer for a violation of section 4 or 5, or a regulation promulgated thereunder, by the deployer or developer.

(2) Relief.— In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award—

(A) actual damages;

(B) punitive damages;

(C) reasonable attorney's fees and litigation costs;

(D) injunctive relief or declaratory relief; or

(E) any other relief that the court determines appropriate.

(d) Relationship to State law.— The provisions of this Act shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this Act. Nothing in this Act shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to minors than the provisions of this Act.

(e) Severability.— If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the remainder of this Act, and the application of such provision to other persons not similarly situated or to other circumstances, shall not be affected by the invalidation.

(a) Rules of construction.— For purposes of enforcing this Act or a regulation promulgated thereunder, in making a determination as to whether a deployer has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen, the Commission or the attorney general of a State, as applicable, shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen. Nothing in this Act, including a determination described in the preceding sentence, shall be construed to require a deployer to—

(1) affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or

(2) implement an age gating or age verification functionality.

(b) Commission guidance.—

(1) In general.— Not later than 180 days after the date of enactment of this Act, the Commission shall issue guidance to provide information for deployers to understand the Commission’s determination of whether a deployer has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen, including best practices and examples.

(2) Limitation.— No guidance issued by the Commission with respect to this Act shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this Act, the Commission or the attorney general of a State, as applicable, shall allege a specific violation of a provision of this Act. The Commission or the attorney general of a State, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this Act. For purposes of enforcing this Act or a regulation promulgated thereunder, the attorney general of a State shall take into account any guidance issued by the Commission under paragraph (1).