CHATBOT Act

This Act may be cited as the “Children’s Health, Advancement, Trust, Boundaries, and Oversight in Technology Act” or the “CHATBOT Act”.

In this Act:

(1) Artificial intelligence.— The term artificial intelligence has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).

(2) Artificial intelligence chatbot.— The term artificial intelligence chatbot means artificial intelligence that, in an open-ended natural-language or multimodal manner—

(A) accepts user input;

(B) engages in interactive conversations with a user; and

(C) provides outputs that are not—

(i) pre-determined or scripted;

(ii) limited to contextualized replies or to a narrow, specified purpose, such as—

(I) customer service;

(II) any operational purpose of a business;

(III) productivity and analysis related to source information;

(IV) internal research; or

(V) technical assistance; or

(iii) limited to an educational product or service that primarily provides information, experience, training, or instruction for the purpose of building any knowledge, skill, or craft.

(3) Child.— The term child means an individual who is under the age of 13.

(4) Commission.— The term Commission means the Federal Trade Commission.

(5) Covered entity.— The term covered entity means any public-facing website, online service, or software application that, as its primary function, provides an artificial intelligence chatbot to users.

(6) Know.— The term know means to have actual knowledge or knowledge fairly implied on the basis of objective circumstances.

(7) Parent.— With respect to a child or teen, the term parent includes a legal guardian of the child or teen.

(8) Personal data.— The term personal data has the meaning given the term personal information in section 1302 of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501).

(9) Targeted advertising.— The term targeted advertising—

(A) means advertising or any other effort to market a product or service to a child or teen user based on any personal data collected from the child or teen; and

(B) does not include—

(i) advertising or marketing to a child or teen user in response to the most recent prompt input by the child or teen user;

(ii) contextual advertising, such as when an advertisement is displayed to a child based on the content of the website, online service, or software application of a covered entity in which the advertisement appears and does not vary based on the personal data of the child or teen user; or

(iii) processing personal data solely for the purpose of measuring or reporting advertising or content performance, reach, or frequency, including independent measurement.

(10) Teen.— The term teen means an individual who has attained 13 years of age but has not attained 18 years of age.

(11) Transparency label.— The term transparency label means a notice that—

(A) is clearly and conspicuously displayed to a user;

(B) disappears only if the user—

(i) exits the artificial intelligence chatbot; or

(ii) affirmatively dismisses the notice; and

(C) discloses that—

(i) the artificial intelligence chatbot is artificial intelligence and not a natural person; and

(ii) any output of the artificial intelligence chatbot is generated using artificial intelligence.

(12) User.— The term user means, with respect to a covered entity, an individual who registers an account or creates a profile in order to access the artificial intelligence chatbot of the covered entity.

(a) Creation and maintenance of family accounts.— A covered entity shall require an individual to create and maintain a family account that meets the requirements described in section 5 to access an artificial intelligence chatbot of the covered entity if the covered entity knows such individual is a child.

(b) Termination of existing user accounts and profiles of child and teen users.— A covered entity shall terminate any user account or profile of an artificial intelligence chatbot of the covered entity that exists as of the effective date of this Act if the covered entity knows such user is—

(1) a child and such child has not created a family account; or

(2) a teen and the parent of such teen has not provided verifiable parental consent pursuant to section 4(a)(1).

(c) Deletion of personal data of children and teens.—

(1) In general.— Subject to paragraph (2), upon termination of a user account or profile pursuant to subsection (b), a covered entity shall immediately delete all personal data collected from the user or submitted by the user (including data of the user collected from or submitted by the parent of such user) to the artificial intelligence chatbot of such entity.

(2) Access of children and teens to personal data.— During the 90-day period beginning on the date on which a covered entity terminates a user account or profile pursuant to subsection (b), to the extent technically feasible and not in violation of any licensing agreement, the covered entity shall make available to such user or parent of such user, upon request, a copy of the personal data collected from the user or submitted by the user to the artificial chatbot of such entity in—

(A) a manner that is readable and able to be understood by a reasonable person; and

(B) a portable, structured, and machine-readable format.

(3) Rule of construction.— Nothing in this subsection shall be construed to prohibit a covered entity from retaining—

(A) a record of the termination of a user account or profile; and

(B) the minimum information necessary for ensuring compliance with this section.

(a) In general.—

(1) Notice and verifiable parental consent.— Prior to an individual's creation of a user account or profile with an artificial intelligence chatbot of a covered entity, if the covered entity knows such individual is a teen, the covered entity shall—

(A) provide direct notice to a parent of the teen of the attempt by such teen to create such user account or profile; and

(B) obtain verifiable parental consent (as defined in section 1302(9) of the Children’s Online Privacy Protection Act (15 U.S.C. 6501(9))) from the parent of the teen in order for the teen to create such user account or profile.

(2) Option for family accounts.— In obtaining verifiable parental consent under paragraph (1), a covered entity shall provide a parent of a teen with the option to create a family account for the teen that meets the requirements described in section 5.

(3) Default features.—

(A) In general.— Subject to subparagraph (B), if the parent of a teen user does not create a family account for the teen as permitted in paragraph (2), a covered entity shall set and fix any feature or setting described in section (5)(a)(1) at the default setting required by section 5(b)(1) for the user account or profile of such teen.

(B) Later creation of a family account.— If a parent of a teen user creates a family account for the teen user after such teen user first creates a user account or profile, the covered entity shall permit such parent to adjust any default setting set and fixed under subparagraph (A).

(4) Reasonable efforts.— A covered entity shall be deemed compliant with the requirements of this subsection if the covered entity is in compliance with the requirements of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) to use reasonable efforts (taking into consideration available technology) to provide a parent with direct notice and to obtain verifiable parental consent.

(b) Revocation of consent.—

(1) In general.— With respect to a parent of a teen who has provided verifiable parental consent under subsection (a)(1), a covered entity shall provide such parent with the ability to revoke such consent.

(2) Effect of verifiable parental consent.— If a covered entity receives a revocation of verifiable parental consent under paragraph (1), the covered entity shall suspend, delete, or otherwise disable the user account or profile of the teen on the artificial intelligence chatbot that is subject to such revocation.

(c) Rule of construction.— Nothing in this section shall be construed to require a covered entity to require a teen or the parent of such teen to provide government-issued identification for—

(1) relationship verification; or

(2) the provision of verifiable parental consent under subsection (a)(1).

(a) Parental controls and settings.— Any family account provided by a covered entity to meet the requirements of section 3 or 4 shall permit the parent of a child or teen user, as applicable, to—

(1) determine the privacy and account settings for the user account or profile of such child or teen, including the ability to—

(A) limit the amount of time the child or teen is able to spend using the artificial intelligence chatbot of the covered entity;

(B) disable rewards or incentives, including badges or other visual award symbols, based on frequency, time spent, or the activity of the child or teen using the artificial intelligence chatbot;

(C) disable notifications and push alerts;

(D) disable any financial transaction made available while using the artificial intelligence chatbot;

(E) disable the generation of an output from the artificial intelligence chatbot that is not in response to the input of a user; and

(F) enable a requirement that the covered entity display a transparency label and set the intervals at which the transparency label should be displayed;

(2) set the number of inputs that, or the period of time during which, an artificial intelligence chatbot may use the personal data of, or such inputs provided by, a child or teen user to generate outputs before such data and such inputs must be deleted from any memory used by the artificial intelligence chatbot to generate outputs;

(3) access—

(A) a full record of the conversations and activity of the child or teen with such artificial intelligence chatbot; and

(B) features that allow the parent to monitor, analyze, and understand, at scale, the record of such conversations and activity; and

(4) receive customized notifications or other alerts when the child or teen attempts to bypass, disable, or violate any parental control or setting described in paragraph (1).

(b) Default safeguards and parental control options.—

(1) Default safeguards.— Each covered entity shall ensure that the default setting of any parental control or setting described in subsection (a) for a family account is the option, or pre-set option (for purposes of paragraph (2)), that provides the most protective level of control with respect to the use of the artificial intelligence chatbot by a child or teen user.

(2) Pre-set options for parents.— Each covered entity shall provide a parent of a child or teen user with the option to select between several pre-set tiered options for governing the settings described in subsection (a)(2) that balance the tradeoffs between the protectiveness to the child or teen user and the effectiveness of the artificial intelligence chatbot.

(c) Disclosure and transparency.—

(1) In general.— Each covered entity shall ensure that the default setting of any parental control or setting described in subsection (a) within a family account is accompanied by a clear and conspicuous disclosure that defines the scope of the setting in a manner that is understandable by an ordinary consumer.

(2) Provision of information.— Prior to the creation of a family account, a covered entity shall provide to the parent of a child or teen clear and conspicuous information, which may include a link to a web page of the covered entity, regarding—

(A) the policies and practices of the covered entity with respect to each parental control or setting described in subsection (a), including an easy-to-understand explanation of the options described in such subsection, the pre-set options described in subsection (b)(2), and the effect of each option or pre-set option; and

(B) how to access and manage the family account for the child or teen user, including an easy-to-understand explanation of how to view, change, and determine each parental control or setting described in subsection (a).

(d) Report.— A covered entity shall provide an easily accessible means for a child or teen user or the parent of such child or teen user to—

(1) report violations of the parental controls or settings specified in subsection (a); and

(2) contact the covered entity with respect to any matter related to child or teen use of the artificial intelligence chatbot of the covered entity.

(a) In general.— A covered entity shall not use the personal data of a user that the covered entity knows is a child or teen for purposes of targeted advertising.

(b) Rule of construction.— Nothing in subsection (a) shall be construed to prohibit a covered entity that knows the age of the child or teen from delivering advertising or marketing that—

(1) complies with the prohibition described in subsection (a); and

(2) is age-appropriate and intended for a child or teen audience, so long as the covered entity does not use any personal information other than the age of the child or teen to display such advertisement.

(a) Rule of construction.— For purposes of determining whether a covered entity knows that an individual is a child or teen, the Commission or attorney general of a State shall rely on competent and reliable evidence, taking into account the totality of circumstances, including whether a reasonable and prudent person under the circumstances would have known that the individual is a child or teen.

(b) Protections for privacy.— Nothing in this Act, including a determination described in subsection (a), shall be construed to require a covered entity to—

(1) implement an age gating or age verification functionality; or

(2) affirmatively collect any personal data with respect to the age of any individual that the covered entity is not already collecting in the normal course of business.

(c) Restriction on use and retention of personal data.— If a covered entity (or a third party acting on behalf of a covered entity) voluntarily collects personal data for the purpose of complying with this Act, the covered entity (or third party) shall not—

(1) use any personal data collected for a purpose other than for sole compliance with the requirements of this Act; or

(2) retain any personal data collected for longer than is necessary to comply with the requirements of this Act or than is minimally necessary to demonstrate such compliance.

(a) Enforcement by the Commission.—

(1) Unfair or deceptive acts or practices.— A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

(2) Powers of the Commission.—

(A) In general.— The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

(B) Privileges and immunities.— Any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

(C) Authority preserved.— Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

(b) Enforcement by States.—

(1) Authorization.— Subject to paragraph (3), in any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of a covered entity in a practice that violates section 3 or 4, the attorney general of the State may, as parens patriae, bring a civil action against the covered entity on behalf of the residents of the State in an appropriate district court of the United States to—

(A) enjoin such practice;

(B) enforce compliance with this Act;

(C) on behalf of residents of the State, obtain damages, restitution, or other compensation, each of which shall be distributed in accordance with State law; or

(D) obtain such other relief as the court may consider to be appropriate.

(2) Rights of the Commission.—

(A) Notice to the Commission.—

(i) In general.— Except as provided in clause (ii), before initiating a civil action under paragraph (1), the attorney general of a State shall provide to the Commission a written notice of such action and a copy of the complaint for such action.

(ii) Exception.— If the attorney general determines that it is not feasible to provide the notice described in clause (i) before initiating a civil action under paragraph (1), the attorney general shall provide written notice of the action and a copy of the complaint to the Commission immediately upon initiating the civil action.

(B) Intervention by the Commission.— Upon receiving the notice required under subparagraph (A), the Commission may—

(i) intervene in the civil action that is the subject of the notice; and

(ii) upon intervening—

(I) be heard with respect to any matter that arises in such action; and

(II) file a petition for appeal for any decision in such action.

(3) Investigatory powers.— Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to—

(A) conduct investigations;

(B) administer oaths or affirmations; or

(C) compel the attendance of witnesses or the production of documentary or other evidence.

(4) Preemptive action by the Commission.— In any case in which an action is instituted by or on behalf of the Commission for a violation of this Act, no State may, during the pendency of that action, institute a separate civil action under paragraph (1) against any defendant named in the complaint in the action instituted by or on behalf of the Commission for that violation.

(5) Venue; service of process.—

(A) Venue.— Any action brought under paragraph (1) may be brought in—

(i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

(ii) another court of competent jurisdiction.

(B) Service of process.— In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

(a) In general.— Subject to subsection (b), the provisions of this Act shall preempt any related State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this Act.

(b) Rules of construction.— Nothing in this Act shall be construed to—

(1) prohibit a State from enacting a law, rule, or regulation that provides greater protection to children than the protections provided in this Act; or

(2) affect the application of—

(A) section 444 of the General Education Provisions Act (20 U.S.C. 1232g, commonly known as the “Family Educational Rights and Privacy Act of 1974”) or other Federal or State laws governing student privacy; or

(B) the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) or any rule or regulation promulgated under such Act.

(a) In general.— Not later than 2 years after the date of enactment of this Act, the Director of the National Science Foundation shall conduct or commission a study on the effects of artificial intelligence chatbots on human relationships and the social needs of children and teens.

(b) Scope.— The study required under subsection (a) shall examine, with respect to children and teens—

(1) the use of artificial intelligence chatbots by children and teens to meet companionship or social needs and the resulting effects on the real-world social engagement and mental health of children and teens;

(2) the prevalence and effects of sycophantic or excessively affirming behavior by artificial intelligence chatbots on children and teens; and

(3) the role of design features of artificial intelligence chatbots in shaping the results of paragraphs (1) and (2).

(c) Methodology.— The study required under subsection (a) shall draw on existing research, expert consultation, and, where feasible, observational, experimental, and survey-based data collection, consistent with applicable ethical standards and requirements for research involving children and teens.

(d) Report.— Not later than 1 year after the date of enactment of this Act, the Director of the National Science Foundation shall submit to the Committee on Commerce, Science and Transportation of the Senate and the Committee on Energy and Commerce and the Committee on Science, Space, and Technology of the House of Representatives a report containing the findings of the study conducted under subsection (a).

(a) In general.— Not later than 2 years after the date described in section 12, the Comptroller General of the United States (in this section referred to as the “Comptroller General”) shall submit a report to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce and the Committee on Science, Space, and Technology of the House of Representatives that examines—

(1) the effectiveness of this Act, including the overall effectiveness of the family account requirements described in sections 3, 4, and 5;

(2) the adoption rate of family accounts by parents of children and teens;

(3) the rate of compliance with the requirements of this Act by covered entities;

(4) the effectiveness of each parental control or setting required within a family account, including recommendations or best practices to provide the most protective or ideal level of control for children and teens, including analysis of the parental control described in section 5(a)(2), including—

(A) using best available research or industry data; and

(B) an analysis of model drift with specific consideration of the number of inputs or the duration of time that causes an artificial intelligence chatbot to generate outputs not consistent with its behavior parameters;

(5) recommendations for parents and covered entities to provide the most protective level of control for children and teens with respect to the use of the parental control described in section 5(a)(2), including recommended settings for limiting the number of inputs or the retention of personal data within the memory of the artificial intelligence chatbot, with reference to the data described in paragraph (4);

(6) recommendations for parents, based on available data, with respect to best practices for maximizing the protection of a child or teen within a family account while ensuring the effectiveness of an artificial intelligence chatbot;

(7) recommendations to the Commission for improving enforcement of this Act; and

(8) recommendations to Congress for potential legislative improvement to this Act.

(b) Consultation requirement.— In carrying out the report required under subsection (a), the Comptroller General shall consult with each of the following:

(1) The National Institute of Standards and Technology.

(2) The Commission.

(3) Representatives of covered entities.

(4) Parents of children or teen users of artificial intelligence chatbots.

(5) Individuals with experience advocating for online child safety, consumer protection, or online privacy.

(6) Individuals with experience in artificial intelligence, computer science, and software engineering.

(7) Academic experts with expertise in prevention of online harms to children or teens.

(8) Other relevant Federal agencies with expertise in child or teen online safety.

This Act shall take effect on the date that is 1 year after the date of enactment of this Act.