S. 4407 — CHATBOT Act

This section defines 12 terms used in the Act, including "artificial intelligence" (as defined in the National Artificial Intelligence Initiative Act of 2020), "artificial intelligence chatbot" (AI that accepts user input for open-ended interactive conversations not limited to predetermined, scripted, narrow-purpose, or primarily educational outputs), "child" (under age 13), "teen" (age 13 to under 18), "covered entity" (public-facing website, online service, or app primarily providing an AI chatbot), "personal data" (as defined in the Children's Online Privacy Protection Act of 1998), "targeted advertising" (marketing to a child or teen based on their personal data, excluding contextual ads or performance measurement), and "transparency label" (conspicuous notice disclosing the AI chatbot's nature that persists until user exit or dismissal).

This section requires a covered entity to (1) mandate that a child create and maintain a family account meeting requirements in section 5 to access the entity's AI chatbot; (2) terminate any existing user account or profile of a child without such a family account or a teen without verifiable parental consent under section 4(a)(1); and (3) immediately delete all personal data collected from or submitted by the terminated user (including by the parent), subject to a 90-day period during which the user or parent may request a copy in a readable, portable, machine-readable format to the extent technically feasible. Covered entities may retain records of terminations and minimum information necessary for compliance.

This section requires a covered entity, prior to a known teen creating a user account or profile on its artificial intelligence chatbot, to (1) provide direct notice to the teen's parent and obtain verifiable parental consent as defined in the Children's Online Privacy Protection Act of 1998 (COPPA); (2) offer the parent an option to create a family account for the teen that meets requirements in section 5; and (3) if no family account is created, set and fix user features described in section 5(a)(1) at the protective defaults required by section 5(b)(1), subject to later parental adjustment upon family account creation. A covered entity is deemed compliant with these notice and consent requirements if it uses COPPA's reasonable efforts standard. The section further requires covered entities to allow parents to revoke consent, which suspends, deletes, or disables the teen's account, and prohibits requiring government-issued identification for relationship verification or consent.

This section requires covered entities providing family accounts for child or teen users of AI chatbots to enable parents to (1) set privacy and account controls—including limiting usage time, disabling rewards or incentives, notifications, financial transactions, unsolicited outputs, and enabling transparency labels; (2) limit retention of the child's or teen's personal data or inputs in the chatbot's memory; (3) access full conversation and activity records with monitoring tools; and (4) receive alerts for bypass attempts. It further requires default settings to be the most protective option, with pre-set tiered alternatives balancing protection and chatbot effectiveness; clear disclosures explaining all settings; pre-account-creation information on policies and management; and accessible reporting for violations or child/teen-related issues.

This section prohibits a covered entity from using the personal data of a known child or teen user for targeted advertising. It clarifies that a covered entity may deliver age-appropriate advertising intended for children or teens, provided it complies with the prohibition and uses no personal data other than the user's age.

This section establishes standards for determining whether a covered entity knows that an individual is a child or teen, requiring the Commission or a state attorney general to rely on competent and reliable evidence under the totality of circumstances, including what a reasonable and prudent person would know. The section further (1) prohibits construing the Act to require age gating, age verification, or collection of age data beyond normal business practices; and (2) restricts any voluntarily collected personal data to compliance purposes only, with retention no longer than necessary to comply or demonstrate compliance.

This section establishes Federal Trade Commission (FTC) enforcement of the Act by treating violations as unfair or deceptive acts or practices under FTC Act section 18(a)(1)(B) (15 U.S.C. 57a(a)(1)(B)) and authorizing the FTC to apply all applicable FTC Act powers, penalties, privileges, and immunities (15 U.S.C. 41 et seq.). It further authorizes state attorneys general to bring parens patriae civil actions in federal district court against covered entities for violations of sections 3 or 4—seeking injunctions, compliance, damages, restitution, or other relief—subject to prior written notice to the FTC (or immediate notice if infeasible), FTC intervention and appeal rights, preservation of state investigatory powers, a bar on parallel state actions during FTC proceedings against the same defendant, and specified venue and service of process rules.

This section provides that the Act preempts conflicting state laws, rules, or regulations only to the extent of such conflict; permits states to enact laws, rules, or regulations providing greater child protections; and preserves the application of the Family Educational Rights and Privacy Act of 1974 (FERPA, 20 U.S.C. 1232g) and the Children’s Online Privacy Protection Act of 1998 (COPPA, 15 U.S.C. 6501 et seq.) or rules promulgated thereunder.

This section directs the Director of the National Science Foundation to conduct or commission a study, due not later than two years after enactment, on the effects of artificial intelligence chatbots on human relationships and the social needs of children and teens. The study must examine, with respect to children and teens, (1) their use of such chatbots to meet companionship or social needs and resulting effects on real-world social engagement and mental health, (2) the prevalence and effects of sycophantic or excessively affirming chatbot behavior, and (3) the role of chatbot design features in shaping results under (1) and (2); the Director must submit a report on the study to the Senate Committee on Commerce, Science, and Transportation and the House Committees on Energy and Commerce and Science, Space, and Technology not later than one year after enactment.

This section requires the Comptroller General of the United States to submit to the Senate Committee on Commerce, Science, and Transportation and the House Committees on Energy and Commerce and Science, Space, and Technology, not later than two years after the date described in section 12, a report examining (1) the effectiveness of this Act, including family account requirements under sections 3, 4, and 5; (2) adoption rates of family accounts by parents of children and teens; (3) compliance rates by covered entities; (4) effectiveness of required parental controls or settings, including recommendations and best practices for optimal protection (using research or industry data) with analysis of model drift in artificial intelligence chatbots under section 5(a)(2); (5) recommendations for parents and covered entities on protective use of the section 5(a)(2) control, including settings to limit inputs or personal data retention in chatbot memory; (6) best practices for parents to maximize child and teen protection within family accounts while preserving chatbot effectiveness; (7) recommendations to the Commission for improved enforcement; and (8) recommendations to Congress for legislative improvements. In preparing the report, the Comptroller General must consult with the National Institute of Standards and Technology, the Commission, representatives of covered entities, parents of child or teen AI chatbot users, child safety and privacy advocates, artificial intelligence and software engineering experts, academics on online harms to children and teens, and other relevant federal agencies.