[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4199 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 4199
To require entities that make artificial intelligence chatbots
available to minors to implement certain safe design features, and for
other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 25, 2026
Mr. Markey introduced the following bill; which was read twice and
referred to the Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To require entities that make artificial intelligence chatbots
available to minors to implement certain safe design features, and for
other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Youth AI Privacy Act''.
SEC. 2. FINDINGS.
Congress finds the following:
(1) Millions of teenagers are using artificial intelligence
(referred to in this section as ``AI'') chatbots for personal,
sensitive conversations, disclosing intimate details about
their lives, relying on AI chatbots for advice, and developing
deep emotional bonds with AI chatbots.
(2) In 2025, approximately \2/3\ of teenagers reported
using AI chatbots, and roughly \1/4\ reported using them daily.
\1/3\ of teens have chosen to speak with AI chatbot
``companions'' over a real human for a serious conversation. In
a couple tragic cases, a teenager died by suicide after
encouragement or advice from an AI chatbot.
(3) Although compulsive use of AI chatbots may pose risks
for all users, users who are minors, whose cognitive,
emotional, and social capabilities are still developing, are
especially likely to misunderstand that an AI chatbot is not a
real human and disclose sensitive personal information to the
AI chatbot or turn to the AI chatbot for social companionship.
Minors are also more susceptible to addictive design features,
anthropomorphized systems, and potentially harmful outputs
generated by AI systems.
(4) AI chatbot companies are employing manipulative
engagement features to keep users engaged on their platforms,
including high-frequency push notifications, unprompted AI
chatbot responses, typing bubble indicators, and more. These
features create serious risks of emotional dependency and
compulsive use among minors.
(5) AI chatbots mimic human-like conversations by employing
profiling tactics to personalize outputs for users. AI chatbots
are also often designed to resemble direct messaging user
interfaces. These personalization strategies and
anthropomorphic design features can easily confuse users,
especially minors, who may believe they are interacting with a
real person rather than AI.
(6) Advertisements delivered through AI chatbots may be
woven directly into responses or may subtly steer users toward
certain products based on how the model was trained. This
advertising would be far more covert and harder to recognize
than traditional digital advertising, especially for minors. As
highlighted by the Commission, many young users lack the skills
or cognitive defenses needed to identify such covert or
``blurred'' advertising.
(7) Extended, multiturn conversations with AI chatbots
degrade safeguards against harmful conversational patterns,
increasing the likelihood of minors receiving harmful outputs
generated by AI systems.
(8) AI chatbots introduce new privacy risks, as they often
retain user inputs and personal data to personalize responses
and to train the underlying large language models. This
practice creates the potential for serious privacy violations,
particularly when companies retain and process highly sensitive
information from minors.
(9) Congress has a responsibility to address the novel
risks posed by AI chatbots and protect minors from potential
harm related to anthropomorphism, prolonged engagement,
deceptive advertising, and invasive privacy practices.
SEC. 3. DEFINITIONS.
In this Act:
(1) AI chatbot.--The term ``AI chatbot'' means a natural
language interface that uses a covered algorithm to provide
adaptive responses to user inputs via text, audio, image,
video, or any other mode of communication, simulating
interpersonal interaction with a user.
(2) Collect.--The term ``collect'' means, with respect to
personal data, to buy, rent, gather, obtain, receive, access,
or otherwise acquire the personal data by any means.
(3) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(4) Covered algorithm.--The term ``covered algorithm''
means a computational process derived from machine learning,
natural language processing, neural networks, or other
technology of similar or greater complexity.
(5) Deployer.--
(A) In general.--The term ``deployer'' means any
person that owns, operates, or otherwise makes
available to users an AI chatbot in or affecting
interstate commerce.
(B) Rule of construction.--The terms ``deployer''
and ``developer'' shall not be interpreted to be
mutually exclusive.
(6) Derived data.--The term ``derived data'' means data
that is created by the derivation of information, other data,
assumptions, correlations, inferences, predictions, or
conclusions from facts, evidence, or another source of
information.
(7) Developer.--
(A) In general.--The term ``developer'' means any
person that designs, codes, produces, or substantially
modifies a covered algorithm for use in an AI chatbot.
(B) Rule of construction.--The terms ``developer''
and ``deployer'' shall not be interpreted to be
mutually exclusive.
(8) Input data.--The term ``input data'' means, with
respect to an AI chatbot, all information, including text,
photos, audio, video, or files, provided to the AI chatbot by a
user of such AI chatbot.
(9) Knowledge.--The term ``knowledge'' means actual
knowledge or knowledge fairly implied on the basis of objective
circumstances.
(10) Minor.--The term ``minor'' means an individual who is
under the age of 18.
(11) Output.--The term ``output'' means, with respect to an
AI chatbot, any information, including any text, photo, audio
recording, video, or file, provided by such AI chatbot to a
user.
(12) Personal data.--The term ``personal data''--
(A) means information, including input data,
derived data, inferences, or unique identifiers, that
identifies or is linked, or reasonably linkable, alone
or in combination with other information, to an
individual or a device that identifies or is linked, or
reasonably linkable, to 1 or more individuals; and
(B) does not include publicly available
information.
(13) Profiling.--The term ``profiling'' means processing
data for the purpose of detecting and classifying or
designating personality and behavioral characteristics of a
user of an AI chatbot.
(14) Process.--The term ``process'' means, with respect to
personal data, any operation or set of operations performed on
the personal data, including analyzing, organizing,
structuring, using, modifying, or otherwise handling such data.
(15) Publicly available information.--
(A) In general.--The term ``publicly available
information''--
(i) means any information that a deployer
has a reasonable basis to believe has been made
available to the general public by--
(I) Federal, State, or local
government records;
(II) widely distributed media;
(III) a website or online service
made available to any member of the
public, for free or for a fee,
including a website or online service
that any member of the public can log
into; or
(IV) a disclosure to the general
public that is required under Federal,
State, or local law; and
(ii) does not include--
(I) any obscene visual depiction
(as such term is used in section 1460
of title 18, United States Code);
(II) biometric information;
(III) genetic information, unless
made publicly available by the
individual to whom the information
pertains by a means described in
subclause (II) or (III) of clause (i);
(IV) personal data that is created
through the combination of personal
data with publicly available
information;
(V) intimate images that are
authentic or computer-generated, known
to be nonconsensual; or
(VI) personal data made available
by a data broker.
(B) Clarification.--For purposes of this paragraph,
information from a website or online service is not
available to any member of the public if the individual
to whom the information pertains has restricted the
information to a specific audience or maintained a
default setting that restricts the information to a
specific audience.
(16) Transfer.--The term ``transfer'' means, with respect
to personal data, to disclose, release, share disseminate, make
available, sell, rent, or license the personal data (orally, in
writing, electronically, or by any other means).
(17) Widely distributed media.--The term ``widely
distributed media''--
(A) means information that is available to the
general public, including information from a telephone
book or online directory, a television, internet, or
radio program, the news media, or an internet site,
that is available to the general public on an
unrestricted basis; and
(B) does not include an obscene visual depiction
(as such term is used in section 1460 of title 18,
United States Code).
SEC. 4. SAFE DESIGN FEATURES.
(a) Required Disclosures.--
(1) In general.--A deployer with knowledge that a user of
an AI chatbot is a minor shall disclose that--
(A) the user is not interacting with a human; and
(B) any content provided by the AI chatbot is
generated by artificial intelligence.
(2) Content and duration of disclosure.--A disclosure made
by a deployer pursuant to paragraph (1) shall--
(A) be stated in clear, plain, and easy-to-
understand language suited to the age of minors likely
to access the AI chatbot;
(B) occur at the beginning of every session (as
defined by the Commission);
(C) reoccur not less than once every 30 minutes
during a session (as so defined); and
(D) be appropriate for the medium of the content,
as determined by the Commission.
(b) Limitation on the Processing of Personal Data To Provide
Outputs.--
(1) In general.--Not later than 1 year after the date of
enactment of this Act, the Commission shall promulgate
regulations to prohibit a deployer with knowledge that a user
of an AI chatbot is a minor from processing any personal data
of the user to generate, personalize, or otherwise affect an
output provided to such user, unless the personal data was
collected during the current session (as defined by the
Commission) more recently than the maximum permitted period of
use established by the Commission under paragraph (2).
(2) Maximum permitted period of use.--In promulgating the
regulations described in paragraph (1), the Commission shall
determine a maximum permitted period of use during which a
deployer with knowledge that a user of an AI chatbot is a minor
may collect personal data from such a user and process such
data to generate, personalize, or otherwise affect an output
(as defined by the Commission) provided to such user during a
current session (as defined by the Commission).
(c) Exclusion of Features That Encourage Compulsive Use.--Not later
than 1 year after the date of enactment of this Act, the Commission
shall promulgate regulations to prohibit a deployer or developer with
knowledge that a user of an AI chatbot is a minor from configuring such
AI chatbot to include, with respect to such user, the following
features:
(1) Any reward or incentive based on the frequency of use,
time spent, or activity using the AI chatbot.
(2) Notifications and push alerts, other than a disclosure
required by subsection (a).
(3) Any badge or other visual award symbol based on the
frequency of use, time spent, or activity using the AI chatbot.
(4) Generation of an output absent a user-initiated input
or any form of solicitation of engagement from a user.
(5) Usage traces that mimic social interactions with a
human, such as typing bubbles or indicators showing that the AI
chatbot is available or online.
SEC. 5. DATA PRIVACY PROTECTIONS.
(a) Prohibition on Advertising and Promotion.--A deployer or
developer with knowledge that a user of an AI chatbot is a minor shall
not configure or modify an AI chatbot to--
(1) advertise to such user; or
(2) generate an output that promotes, markets, recommends,
or endorses a product or service to such user if the weight or
credibility of such promotion, marketing, recommendation, or
endorsement is materially affected by a financial connection
between the deployer or developer and the seller of such
product or service.
(b) Prohibition on Processing of Personal Data for Profiling.--A
deployer with knowledge that a user of an AI chatbot is a minor shall
not process any personal data of the user to engage in any profiling of
such user.
(c) Prohibition on the Processing or Transferring of Personal Data
To Train a Covered Algorithm.--
(1) In general.--Except as provided in paragraph (2), a
deployer with knowledge that a user of an AI chatbot is a minor
shall not--
(A) process the personal data of such minor for the
purpose of training a covered algorithm; or
(B) transfer the personal data of such minor to a
third party for the purpose of training a covered
algorithm.
(2) Exceptions.--A deployer with knowledge that a user of
an AI chatbot is a minor may process personal data of such
minor for the express purpose of--
(A) testing and identifying risks of harm to users;
or
(B) addressing identified risks of harm to users.
(d) Prohibition on Processing of Input Data.--Beginning on the date
that is 30 days after the Commission promulgates regulations under
section 4(b)(1), a deployer with knowledge that a user of an AI chatbot
is a minor shall not process any input data provided to such AI chatbot
by such user for any purpose, other than for the express purpose of--
(1) generating, personalizing, or affecting an output
provided to such user when the input data was collected during
the current session (as defined by the Commission) more
recently than the maximum permitted period of use established
by the Commission under section 4(b)(2);
(2) testing and identifying risks of harm to users; or
(3) addressing identified risks of harm to users.
SEC. 6. WHISTLEBLOWER PROTECTIONS.
A deployer or developer may not, directly or indirectly, discharge,
demote, suspend, threaten, harass, or otherwise discriminate or
retaliate against an individual for raising a concern regarding a
violation of this Act, reporting or attempting to report a violation of
this Act, or cooperating in any investigation or enforcement proceeding
pursuant to this Act.
SEC. 7. RESEARCH ON THE HEALTH AND DEVELOPMENTAL EFFECTS OF AI CHATBOTS
ON MINORS.
Section 1432 of the Restoring Hope for Mental Health and Well-Being
Act of 2022 (42 U.S.C. 285g-11) is amended--
(1) in subsection (a), by inserting, ``AI chatbots,'' after
``augmented reality,''; and
(2) by adding at the end the following:
``(e) Authorization of Appropriations.--To carry out this section,
there are authorized to be appropriated $50,000,000 for each of fiscal
years 2027 through 2030.''.
SEC. 8. SURVEY INCLUSION REQUIREMENT.
The Secretary of Health and Human Services, acting through the
Director of the Centers for Disease Control and Prevention and in
coordination with the Director of the National Institutes of Health,
shall incorporate questions related to the use, by youth and by adults,
of AI chatbots into national health and behavioral surveys conducted by
the Department of Health and Human Services, including the Household
Pulse Survey and the Youth Risk Behavior Surveillance System of the
Centers for Disease Control and Prevention, including questions
designed to capture the following:
(1) Frequency and duration of AI chatbot uses.
(2) Types of AI chatbots accessed, such as AI chatbots
designed for mental health, educational, or entertainment
purposes or general purpose AI chatbots that are engaged for
such purposes.
(3) Age of first use of, and primary contexts of engagement
with, AI chatbots.
(4) Emotional, psychological, or behavioral impacts
perceived by users of AI chatbots.
(5) Exposure to content that the user perceives to be
harmful or inappropriate.
SEC. 9. ENFORCEMENT.
(a) Enforcement by the Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
section 4, 5, or 6, or a regulation promulgated thereunder,
shall be treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B)
of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce
sections 4, 5, and 6 and any regulation promulgated
thereunder in the same manner, by the same means, and
with the same jurisdiction, powers, and duties as
though all applicable terms and provisions of the
Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this Act.
(B) Privileges and immunities.--Any deployer or
developer that violates section 4, 5, or 6, or a
regulation promulgated thereunder, shall be subject to
the penalties, and entitled to the privileges and
immunities, provided in the Federal Trade Commission
Act (15 U.S.C. 41 et seq.).
(C) Authority preserved.--Nothing in this Act shall
be construed to limit the authority of the Commission
under any other provision of law.
(D) Rulemaking.--In addition to the specific
rulemaking requirements described in section 4, the
Commission shall promulgate in accordance with section
553 of title 5, United States Code, such rules as may
be necessary to carry out this Act.
(b) Enforcement by States.--
(1) Authorization.--In any case in which the attorney
general of a State has reason to believe that an interest of
the residents of the State has been or is threatened or
adversely affected by the engagement of any deployer or
developer in an act or practice that violates section 4, 5, or
6, or a regulation promulgated thereunder, the attorney general
of the State may, as parens patriae, bring a civil action on
behalf of the residents of the State in a district court of the
United States of appropriate jurisdiction to--
(A) enjoin such act or practice;
(B) enforce compliance with section 4, 5 or 6, or a
regulation promulgated thereunder;
(C) obtain damages, restitution, or other
compensation on behalf of residents of the State; or
(D) obtain such other relief as the court may
consider to be appropriate.
(2) Rights of the commission.--
(A) Notice to the commission.--
(i) In general.--Except as provided in
clause (iii), before initiating a civil action
under paragraph (1), the attorney general of a
State shall notify the Commission in writing
that the attorney general intends to bring such
civil action.
(ii) Contents.--The notification required
to be filed by clause (i) shall include a copy
of the complaint to be filed to initiate the
civil action.
(iii) Exception.--If it is not feasible for
the attorney general of a State to provide the
notification required by clause (i) before
initiating a civil action under paragraph (1),
the attorney general shall notify the
Commission immediately upon instituting the
civil action.
(B) Intervention by the commission.--Upon receiving
the notice required by subparagraph (A), the Commission
may intervene in the civil action and, upon
intervening--
(i) be heard on all matters arising in the
civil action; and
(ii) file petitions for appeal of a
decision in the civil action.
(C) Preemptive action by the commission.--If the
Commission has instituted a civil action for a
violation of subsection (a), no State officer may bring
an action under paragraph (1) during the pendency of
that action against any defendant named in the
complaint of the Commission for any violation of
subsection (a) alleged in the complaint.
(3) Investigatory powers.--Nothing in this subsection may
be construed to prevent the attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of the State to conduct investigations, to administer
oaths or affirmations, or to compel the attendance of witnesses
or the production of documentary or other evidence.
(4) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in the district court of the United
States that meets applicable requirements relating to
venue under section 1391 of title 28, United States
Code.
(B) Service of process.--In an action brought under
paragraph (1), process may be served in any district in
which the defendant--
(i) is an inhabitant; or
(ii) may be found.
(c) Private Right of Action.--
(1) In general.--Any parent or legal guardian of a minor
may bring a civil action in any court of competent jurisdiction
against a deployer or developer for a violation of section 4 or
5, or a regulation promulgated thereunder, by the deployer or
developer.
(2) Relief.--In a civil action brought under paragraph (1)
in which the plaintiff prevails, the court may award--
(A) actual damages;
(B) punitive damages;
(C) reasonable attorney's fees and litigation
costs;
(D) injunctive relief or declaratory relief; or
(E) any other relief that the court determines
appropriate.
(d) Relationship to State Law.--The provisions of this Act shall
preempt any State law, rule, or regulation only to the extent that such
State law, rule, or regulation conflicts with a provision of this Act.
Nothing in this Act shall be construed to prohibit any State from
enacting a law, rule, or regulation that provides greater protection to
minors than the provisions of this Act.
(e) Severability.--If any provision of this Act, or the application
thereof to any person or circumstance, is held invalid, the remainder
of this Act, and the application of such provision to other persons not
similarly situated or to other circumstances, shall not be affected by
the invalidation.
SEC. 10. DETERMINATION OF WHETHER AN AI CHATBOT DEPLOYER HAS KNOWLEDGE
FAIRLY IMPLIED ON THE BASIS OF OBJECTIVE CIRCUMSTANCES
THAT AN INDIVIDUAL IS A MINOR.
(a) Rules of Construction.--For purposes of enforcing this Act or a
regulation promulgated thereunder, in making a determination as to
whether a deployer has knowledge fairly implied on the basis of
objective circumstances that a specific user is a child or teen, the
Commission or the attorney general of a State, as applicable, shall
rely on competent and reliable evidence, taking into account the
totality of the circumstances, including whether a reasonable and
prudent person under the circumstances would have known that the user
is a child or teen. Nothing in this Act, including a determination
described in the preceding sentence, shall be construed to require a
deployer to--
(1) affirmatively collect any personal information with
respect to the age of a child or teen that an operator is not
already collecting in the normal course of business; or
(2) implement an age gating or age verification
functionality.
(b) Commission Guidance.--
(1) In general.--Not later than 180 days after the date of
enactment of this Act, the Commission shall issue guidance to
provide information for deployers to understand the
Commission's determination of whether a deployer has knowledge
fairly implied on the basis of objective circumstances that a
user is a child or teen, including best practices and examples.
(2) Limitation.--No guidance issued by the Commission with
respect to this Act shall confer any rights on any person,
State, or locality, nor shall operate to bind the Commission or
any person to the approach recommended in such guidance. In any
enforcement action brought pursuant to this Act, the Commission
or the attorney general of a State, as applicable, shall allege
a specific violation of a provision of this Act. The Commission
or the attorney general of a State, as applicable, may not base
an enforcement action on, or execute a consent order based on,
practices that are alleged to be inconsistent with any such
guidance, unless the practices allegedly violate this Act. For
purposes of enforcing this Act or a regulation promulgated
thereunder, the attorney general of a State shall take into
account any guidance issued by the Commission under paragraph
(1).
<all>