WeVote
Log In

Bill

Bill

S 4407

CHATBOT Act

119th Congress Introduced by Ted Cruz and 3 co-sponsors

The bill requires parental consent and establishes family accounts for minors to access AI chatbots, with strong parental controls and protections on data use.

Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.
0
WeVote Research Nonpartisan
Bill Summary · S 4407

Overview

S.4407, the CHATBOT Act, introduced in the 119th Congress, aims to regulate the use of artificial intelligence (AI) chatbots by children and teens. The core goals are to create family accounts for children, require verifiable parental consent for teen users, limit targeted advertising based on age, enhance transparency, and strengthen enforcement and oversight. The bill establishes definitions, privacy protections, parental controls, and study requirements to assess impacts on child and teen well-being.

Main purpose and intent

  • Mandate family accounts for minors to access AI chatbots.
  • Require verifiable parental consent for teen users before creating or maintaining teen accounts.
  • Limit targeted advertising to children and teens and provide transparency about data practices.
  • Establish parental controls and default protective safeguards within family accounts.
  • Preempt conflicting state law where appropriate, while allowing stronger state protections.
  • Commission studies and reporting to evaluate social and developmental impacts of AI chatbots on minors.
  • Provide FTC enforcement and state-level enforcement options, plus GAO/NSF-related monitoring.

Key provisions and changes

  • Definitions (Section 2)
    • Artificial Intelligence (as defined by the National AI Initiative Act of 2020).
    • AI chatbot: interactive, open-ended, natural-language or multimodal outputs not purely scripted or solely educational.
    • Child: under 13; Teen: 13 to under 18.
    • Covered entity: public-facing website, online service, or app whose primary function is providing an AI chatbot.
    • Personal data, targeted advertising, transparency label, user, parent, etc.
  • Family accounts and data deletion (Section 3)
    • Covered entities must require a family account for access if the user is a child.
    • Terminate existing child accounts that have not created a family account, and teen accounts without verifiable parental consent.
    • Upon termination, delete all personal data from the child/teen user, with a 90-day window to provide a copy of data to the user/parent, in readable and machine-readable formats (where feasible).
  • Verifiable parental consent and teen family options (Section 4)
    • Before teen account creation, the entity must notify the parent and obtain verifiable parental consent.
    • Parent may opt to create a family account for the teen.
    • Default settings must favor protective controls if the parent does not set a family account; parents can later adjust settings.
    • Parents can revoke consent, which suspends or deletes the teen’s account.
  • Parental controls and settings (Section 5)
    • Family accounts allow parents to:
    • Set privacy and account settings, including time limits, disable incentives/rewards, disable notifications, restrict financial transactions, and require transparency labels.
    • Limit data inputs used to generate outputs and control memory retention for personal data.
    • Access full conversation records and monitoring tools at scale.
    • Receive alerts if the teen attempts to bypass controls.
    • Default safeguards are the most protective; parents can choose among preset tiers balancing protection and chatbot effectiveness.
    • Require disclosures and information before creating a family account about policies, options, and how to manage the account.
    • Provide a mechanism to report violations and contact the entity.
  • Prohibition on targeted advertising (Section 6)
    • Covered entities may not use a child/teen’s personal data for targeted advertising.
    • Age-appropriate, non-personal-data-based advertising is allowed if age is known, provided it does not rely on personal data beyond age.
  • Determination of knowledge of minor status (Section 7)
    • Agencies rely on totality of circumstances; does not require age verification or collecting government-issued IDs.
    • Restrictions on collecting age-related data beyond what is already collected.
  • Enforcement (Section 8)
    • FTC enforcement as a violation of unfair or deceptive acts or practices.
    • State attorneys general may bring parens patriae actions, with notice to the FTC and potential Commission intervention.
    • Preemption provisions allow federal action to supersede conflicting state laws, while preserving higher protections where applicable.
  • Relationship to other laws (Section 9)
    • Preemption limited to conflicts; does not weaken higher state protections or existing federal privacy laws like COPPA or FERPA.
  • Studies and oversight (Sections 10–12)
    • NSF must study the impact of AI chatbots on child/teen relationships and social needs within 2 years; report within 1 year to Congress.
    • GAO to report within 2 years on effectiveness, adoption, compliance, best practices, and recommendations.
    • Effective date: 1 year after enactment.

Affected entities and individuals

  • Covered entities that primarily provide AI chatbots to users (e.g., consumer websites, apps, or online services).
  • Children under 13 and teens 13–17 who use AI chatbots via those services.
  • Parents or legal guardians of children and teens.
  • State attorneys general and the FTC, for enforcement.
  • Federal agencies and oversight bodies (NSF, GAO) for studies and reporting.

Procedural and timeline aspects

  • Effective date: 1 year after enactment.
  • Transition: requires termination of certain existing accounts and material data deletion as of the Act’s effective date.
  • Ongoing enforcement and reporting: annual or periodic reporting to Congress; studies to be conducted within specified timeframes after enactment.
  • Preemption and interaction with existing privacy laws: the Act contemplates coordination with COPPA, FERPA, and related laws, with supremacy where conflicts arise.

If you’d like, I can provide a side-by-side comparison with COPPA/FERPA or a quick risk/impact assessment for stakeholders.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.