[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4407 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 4407
To require the creation of family accounts for children to be able to
use artificial intelligence chatbots, to require verifiable parental
consent for teens using artificial intelligence chatbots, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
April 28, 2026
Mr. Cruz (for himself, Mr. Schatz, Mr. Curtis, and Mr. Schiff)
introduced the following bill; which was read twice and referred to the
Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To require the creation of family accounts for children to be able to
use artificial intelligence chatbots, to require verifiable parental
consent for teens using artificial intelligence chatbots, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Children's Health, Advancement,
Trust, Boundaries, and Oversight in Technology Act'' or the ``CHATBOT
Act''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given such term in section 5002
of the National Artificial Intelligence Initiative Act of 2020
(15 U.S.C. 9401).
(2) Artificial intelligence chatbot.--The term ``artificial
intelligence chatbot'' means artificial intelligence that, in
an open-ended natural-language or multimodal manner--
(A) accepts user input;
(B) engages in interactive conversations with a
user; and
(C) provides outputs that are not--
(i) pre-determined or scripted;
(ii) limited to contextualized replies or
to a narrow, specified purpose, such as--
(I) customer service;
(II) any operational purpose of a
business;
(III) productivity and analysis
related to source information;
(IV) internal research; or
(V) technical assistance; or
(iii) limited to an educational product or
service that primarily provides information,
experience, training, or instruction for the
purpose of building any knowledge, skill, or
craft.
(3) Child.--The term ``child'' means an individual who is
under the age of 13.
(4) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(5) Covered entity.--The term ``covered entity'' means any
public-facing website, online service, or software application
that, as its primary function, provides an artificial
intelligence chatbot to users.
(6) Know.--The term ``know'' means to have actual knowledge
or knowledge fairly implied on the basis of objective
circumstances.
(7) Parent.--With respect to a child or teen, the term
``parent'' includes a legal guardian of the child or teen.
(8) Personal data.--The term ``personal data'' has the
meaning given the term ``personal information'' in section 1302
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6501).
(9) Targeted advertising.--The term ``targeted
advertising''--
(A) means advertising or any other effort to market
a product or service to a child or teen user based on
any personal data collected from the child or teen; and
(B) does not include--
(i) advertising or marketing to a child or
teen user in response to the most recent prompt
input by the child or teen user;
(ii) contextual advertising, such as when
an advertisement is displayed to a child based
on the content of the website, online service,
or software application of a covered entity in
which the advertisement appears and does not
vary based on the personal data of the child or
teen user; or
(iii) processing personal data solely for
the purpose of measuring or reporting
advertising or content performance, reach, or
frequency, including independent measurement.
(10) Teen.--The term ``teen'' means an individual who has
attained 13 years of age but has not attained 18 years of age.
(11) Transparency label.--The term ``transparency label''
means a notice that--
(A) is clearly and conspicuously displayed to a
user;
(B) disappears only if the user--
(i) exits the artificial intelligence
chatbot; or
(ii) affirmatively dismisses the notice;
and
(C) discloses that--
(i) the artificial intelligence chatbot is
artificial intelligence and not a natural
person; and
(ii) any output of the artificial
intelligence chatbot is generated using
artificial intelligence.
(12) User.--The term ``user'' means, with respect to a
covered entity, an individual who registers an account or
creates a profile in order to access the artificial
intelligence chatbot of the covered entity.
SEC. 3. FAMILY ACCOUNT REQUIREMENT FOR CHILDREN; TERMINATION OF
EXISTING USER ACCOUNTS AND PROFILES; DELETION OF PERSONAL
DATA.
(a) Creation and Maintenance of Family Accounts.--A covered entity
shall require an individual to create and maintain a family account
that meets the requirements described in section 5 to access an
artificial intelligence chatbot of the covered entity if the covered
entity knows such individual is a child.
(b) Termination of Existing User Accounts and Profiles of Child and
Teen Users.--A covered entity shall terminate any user account or
profile of an artificial intelligence chatbot of the covered entity
that exists as of the effective date of this Act if the covered entity
knows such user is--
(1) a child and such child has not created a family
account; or
(2) a teen and the parent of such teen has not provided
verifiable parental consent pursuant to section 4(a)(1).
(c) Deletion of Personal Data of Children and Teens.--
(1) In general.--Subject to paragraph (2), upon termination
of a user account or profile pursuant to subsection (b), a
covered entity shall immediately delete all personal data
collected from the user or submitted by the user (including
data of the user collected from or submitted by the parent of
such user) to the artificial intelligence chatbot of such
entity.
(2) Access of children and teens to personal data.--During
the 90-day period beginning on the date on which a covered
entity terminates a user account or profile pursuant to
subsection (b), to the extent technically feasible and not in
violation of any licensing agreement, the covered entity shall
make available to such user or parent of such user, upon
request, a copy of the personal data collected from the user or
submitted by the user to the artificial chatbot of such entity
in--
(A) a manner that is readable and able to be
understood by a reasonable person; and
(B) a portable, structured, and machine-readable
format.
(3) Rule of construction.--Nothing in this subsection shall
be construed to prohibit a covered entity from retaining--
(A) a record of the termination of a user account
or profile; and
(B) the minimum information necessary for ensuring
compliance with this section.
SEC. 4. VERIFIABLE PARENTAL CONSENT AND OPTION FOR FAMILY ACCOUNTS FOR
TEENS.
(a) In General.--
(1) Notice and verifiable parental consent.--Prior to an
individual's creation of a user account or profile with an
artificial intelligence chatbot of a covered entity, if the
covered entity knows such individual is a teen, the covered
entity shall--
(A) provide direct notice to a parent of the teen
of the attempt by such teen to create such user account
or profile; and
(B) obtain verifiable parental consent (as defined
in section 1302(9) of the Children's Online Privacy
Protection Act (15 U.S.C. 6501(9))) from the parent of
the teen in order for the teen to create such user
account or profile.
(2) Option for family accounts.--In obtaining verifiable
parental consent under paragraph (1), a covered entity shall
provide a parent of a teen with the option to create a family
account for the teen that meets the requirements described in
section 5.
(3) Default features.--
(A) In general.--Subject to subparagraph (B), if
the parent of a teen user does not create a family
account for the teen as permitted in paragraph (2), a
covered entity shall set and fix any feature or setting
described in section (5)(a)(1) at the default setting
required by section 5(b)(1) for the user account or
profile of such teen.
(B) Later creation of a family account.--If a
parent of a teen user creates a family account for the
teen user after such teen user first creates a user
account or profile, the covered entity shall permit
such parent to adjust any default setting set and fixed
under subparagraph (A).
(4) Reasonable efforts.--A covered entity shall be deemed
compliant with the requirements of this subsection if the
covered entity is in compliance with the requirements of the
Children's Online Privacy Protection Act of 1998 (15 U.S.C.
6501 et seq.) to use reasonable efforts (taking into
consideration available technology) to provide a parent with
direct notice and to obtain verifiable parental consent.
(b) Revocation of Consent.--
(1) In general.--With respect to a parent of a teen who has
provided verifiable parental consent under subsection (a)(1), a
covered entity shall provide such parent with the ability to
revoke such consent.
(2) Effect of verifiable parental consent.--If a covered
entity receives a revocation of verifiable parental consent
under paragraph (1), the covered entity shall suspend, delete,
or otherwise disable the user account or profile of the teen on
the artificial intelligence chatbot that is subject to such
revocation.
(c) Rule of Construction.--Nothing in this section shall be
construed to require a covered entity to require a teen or the parent
of such teen to provide government-issued identification for--
(1) relationship verification; or
(2) the provision of verifiable parental consent under
subsection (a)(1).
SEC. 5. PARENTAL CONTROLS AND SETTINGS FOR FAMILY ACCOUNTS.
(a) Parental Controls and Settings.--Any family account provided by
a covered entity to meet the requirements of section 3 or 4 shall
permit the parent of a child or teen user, as applicable, to--
(1) determine the privacy and account settings for the user
account or profile of such child or teen, including the ability
to--
(A) limit the amount of time the child or teen is
able to spend using the artificial intelligence chatbot
of the covered entity;
(B) disable rewards or incentives, including badges
or other visual award symbols, based on frequency, time
spent, or the activity of the child or teen using the
artificial intelligence chatbot;
(C) disable notifications and push alerts;
(D) disable any financial transaction made
available while using the artificial intelligence
chatbot;
(E) disable the generation of an output from the
artificial intelligence chatbot that is not in response
to the input of a user; and
(F) enable a requirement that the covered entity
display a transparency label and set the intervals at
which the transparency label should be displayed;
(2) set the number of inputs that, or the period of time
during which, an artificial intelligence chatbot may use the
personal data of, or such inputs provided by, a child or teen
user to generate outputs before such data and such inputs must
be deleted from any memory used by the artificial intelligence
chatbot to generate outputs;
(3) access--
(A) a full record of the conversations and activity
of the child or teen with such artificial intelligence
chatbot; and
(B) features that allow the parent to monitor,
analyze, and understand, at scale, the record of such
conversations and activity; and
(4) receive customized notifications or other alerts when
the child or teen attempts to bypass, disable, or violate any
parental control or setting described in paragraph (1).
(b) Default Safeguards and Parental Control Options.--
(1) Default safeguards.--Each covered entity shall ensure
that the default setting of any parental control or setting
described in subsection (a) for a family account is the option,
or pre-set option (for purposes of paragraph (2)), that
provides the most protective level of control with respect to
the use of the artificial intelligence chatbot by a child or
teen user.
(2) Pre-set options for parents.--Each covered entity shall
provide a parent of a child or teen user with the option to
select between several pre-set tiered options for governing the
settings described in subsection (a)(2) that balance the
tradeoffs between the protectiveness to the child or teen user
and the effectiveness of the artificial intelligence chatbot.
(c) Disclosure and Transparency.--
(1) In general.--Each covered entity shall ensure that the
default setting of any parental control or setting described in
subsection (a) within a family account is accompanied by a
clear and conspicuous disclosure that defines the scope of the
setting in a manner that is understandable by an ordinary
consumer.
(2) Provision of information.--Prior to the creation of a
family account, a covered entity shall provide to the parent of
a child or teen clear and conspicuous information, which may
include a link to a web page of the covered entity, regarding--
(A) the policies and practices of the covered
entity with respect to each parental control or setting
described in subsection (a), including an easy-to-
understand explanation of the options described in such
subsection, the pre-set options described in subsection
(b)(2), and the effect of each option or pre-set
option; and
(B) how to access and manage the family account for
the child or teen user, including an easy-to-understand
explanation of how to view, change, and determine each
parental control or setting described in subsection
(a).
(d) Report.--A covered entity shall provide an easily accessible
means for a child or teen user or the parent of such child or teen user
to--
(1) report violations of the parental controls or settings
specified in subsection (a); and
(2) contact the covered entity with respect to any matter
related to child or teen use of the artificial intelligence
chatbot of the covered entity.
SEC. 6. PROHIBITION ON TARGETED ADVERTISING.
(a) In General.--A covered entity shall not use the personal data
of a user that the covered entity knows is a child or teen for purposes
of targeted advertising.
(b) Rule of Construction.--Nothing in subsection (a) shall be
construed to prohibit a covered entity that knows the age of the child
or teen from delivering advertising or marketing that--
(1) complies with the prohibition described in subsection
(a); and
(2) is age-appropriate and intended for a child or teen
audience, so long as the covered entity does not use any
personal information other than the age of the child or teen to
display such advertisement.
SEC. 7. DETERMINATION OF WHETHER A COVERED ENTITY KNOWS THAT AN
INDIVIDUAL IS A CHILD OR TEEN.
(a) Rule of Construction.--For purposes of determining whether a
covered entity knows that an individual is a child or teen, the
Commission or attorney general of a State shall rely on competent and
reliable evidence, taking into account the totality of circumstances,
including whether a reasonable and prudent person under the
circumstances would have known that the individual is a child or teen.
(b) Protections for Privacy.--Nothing in this Act, including a
determination described in subsection (a), shall be construed to
require a covered entity to--
(1) implement an age gating or age verification
functionality; or
(2) affirmatively collect any personal data with respect to
the age of any individual that the covered entity is not
already collecting in the normal course of business.
(c) Restriction on Use and Retention of Personal Data.--If a
covered entity (or a third party acting on behalf of a covered entity)
voluntarily collects personal data for the purpose of complying with
this Act, the covered entity (or third party) shall not--
(1) use any personal data collected for a purpose other
than for sole compliance with the requirements of this Act; or
(2) retain any personal data collected for longer than is
necessary to comply with the requirements of this Act or than
is minimally necessary to demonstrate such compliance.
SEC. 8. ENFORCEMENT.
(a) Enforcement by the Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
this Act shall be treated as a violation of a rule defining an
unfair or deceptive act or practice prescribed under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce this
Act in the same manner, by the same means, and with the
same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this Act.
(B) Privileges and immunities.--Any person who
violates this Act shall be subject to the penalties and
entitled to the privileges and immunities provided in
the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(C) Authority preserved.--Nothing in this Act shall
be construed to limit the authority of the Commission
under any other provision of law.
(b) Enforcement by States.--
(1) Authorization.--Subject to paragraph (3), in any case
in which the attorney general of a State has reason to believe
that an interest of the residents of the State has been or is
threatened or adversely affected by the engagement of a covered
entity in a practice that violates section 3 or 4, the attorney
general of the State may, as parens patriae, bring a civil
action against the covered entity on behalf of the residents of
the State in an appropriate district court of the United States
to--
(A) enjoin such practice;
(B) enforce compliance with this Act;
(C) on behalf of residents of the State, obtain
damages, restitution, or other compensation, each of
which shall be distributed in accordance with State
law; or
(D) obtain such other relief as the court may
consider to be appropriate.
(2) Rights of the commission.--
(A) Notice to the commission.--
(i) In general.--Except as provided in
clause (ii), before initiating a civil action
under paragraph (1), the attorney general of a
State shall provide to the Commission a written
notice of such action and a copy of the
complaint for such action.
(ii) Exception.--If the attorney general
determines that it is not feasible to provide
the notice described in clause (i) before
initiating a civil action under paragraph (1),
the attorney general shall provide written
notice of the action and a copy of the
complaint to the Commission immediately upon
initiating the civil action.
(B) Intervention by the commission.--Upon receiving
the notice required under subparagraph (A), the
Commission may--
(i) intervene in the civil action that is
the subject of the notice; and
(ii) upon intervening--
(I) be heard with respect to any
matter that arises in such action; and
(II) file a petition for appeal for
any decision in such action.
(3) Investigatory powers.--Nothing in this subsection may
be construed to prevent the attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of the State to--
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the
production of documentary or other evidence.
(4) Preemptive action by the commission.--In any case in
which an action is instituted by or on behalf of the Commission
for a violation of this Act, no State may, during the pendency
of that action, institute a separate civil action under
paragraph (1) against any defendant named in the complaint in
the action instituted by or on behalf of the Commission for
that violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in--
(i) the district court of the United States
that meets applicable requirements relating to
venue under section 1391 of title 28, United
States Code; or
(ii) another court of competent
jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1), process may be served in any district in
which the defendant--
(i) is an inhabitant; or
(ii) may be found.
SEC. 9. RELATIONSHIP TO OTHER LAWS.
(a) In General.--Subject to subsection (b), the provisions of this
Act shall preempt any related State law, rule, or regulation only to
the extent that such State law, rule, or regulation conflicts with a
provision of this Act.
(b) Rules of Construction.--Nothing in this Act shall be construed
to--
(1) prohibit a State from enacting a law, rule, or
regulation that provides greater protection to children than
the protections provided in this Act; or
(2) affect the application of--
(A) section 444 of the General Education Provisions
Act (20 U.S.C. 1232g, commonly known as the ``Family
Educational Rights and Privacy Act of 1974'') or other
Federal or State laws governing student privacy; or
(B) the Children's Online Privacy Protection Act of
1998 (15 U.S.C. 6501 et seq.) or any rule or regulation
promulgated under such Act.
SEC. 10. STUDY ON THE IMPACT OF ARTIFICIAL INTELLIGENCE CHATBOTS ON
CHILD AND TEEN HUMAN RELATIONSHIPS AND SOCIAL NEEDS.
(a) In General.--Not later than 2 years after the date of enactment
of this Act, the Director of the National Science Foundation shall
conduct or commission a study on the effects of artificial intelligence
chatbots on human relationships and the social needs of children and
teens.
(b) Scope.--The study required under subsection (a) shall examine,
with respect to children and teens--
(1) the use of artificial intelligence chatbots by children
and teens to meet companionship or social needs and the
resulting effects on the real-world social engagement and
mental health of children and teens;
(2) the prevalence and effects of sycophantic or
excessively affirming behavior by artificial intelligence
chatbots on children and teens; and
(3) the role of design features of artificial intelligence
chatbots in shaping the results of paragraphs (1) and (2).
(c) Methodology.--The study required under subsection (a) shall
draw on existing research, expert consultation, and, where feasible,
observational, experimental, and survey-based data collection,
consistent with applicable ethical standards and requirements for
research involving children and teens.
(d) Report.--Not later than 1 year after the date of enactment of
this Act, the Director of the National Science Foundation shall submit
to the Committee on Commerce, Science and Transportation of the Senate
and the Committee on Energy and Commerce and the Committee on Science,
Space, and Technology of the House of Representatives a report
containing the findings of the study conducted under subsection (a).
SEC. 11. GAO REPORT ON RECOMMENDATIONS AND BEST PRACTICES.
(a) In General.--Not later than 2 years after the date described in
section 12, the Comptroller General of the United States (in this
section referred to as the ``Comptroller General'') shall submit a
report to the Committee on Commerce, Science, and Transportation of the
Senate and the Committee on Energy and Commerce and the Committee on
Science, Space, and Technology of the House of Representatives that
examines--
(1) the effectiveness of this Act, including the overall
effectiveness of the family account requirements described in
sections 3, 4, and 5;
(2) the adoption rate of family accounts by parents of
children and teens;
(3) the rate of compliance with the requirements of this
Act by covered entities;
(4) the effectiveness of each parental control or setting
required within a family account, including recommendations or
best practices to provide the most protective or ideal level of
control for children and teens, including analysis of the
parental control described in section 5(a)(2), including--
(A) using best available research or industry data;
and
(B) an analysis of model drift with specific
consideration of the number of inputs or the duration
of time that causes an artificial intelligence chatbot
to generate outputs not consistent with its behavior
parameters;
(5) recommendations for parents and covered entities to
provide the most protective level of control for children and
teens with respect to the use of the parental control described
in section 5(a)(2), including recommended settings for limiting
the number of inputs or the retention of personal data within
the memory of the artificial intelligence chatbot, with
reference to the data described in paragraph (4);
(6) recommendations for parents, based on available data,
with respect to best practices for maximizing the protection of
a child or teen within a family account while ensuring the
effectiveness of an artificial intelligence chatbot;
(7) recommendations to the Commission for improving
enforcement of this Act; and
(8) recommendations to Congress for potential legislative
improvement to this Act.
(b) Consultation Requirement.--In carrying out the report required
under subsection (a), the Comptroller General shall consult with each
of the following:
(1) The National Institute of Standards and Technology.
(2) The Commission.
(3) Representatives of covered entities.
(4) Parents of children or teen users of artificial
intelligence chatbots.
(5) Individuals with experience advocating for online child
safety, consumer protection, or online privacy.
(6) Individuals with experience in artificial intelligence,
computer science, and software engineering.
(7) Academic experts with expertise in prevention of online
harms to children or teens.
(8) Other relevant Federal agencies with expertise in child
or teen online safety.
SEC. 12. EFFECTIVE DATE.
This Act shall take effect on the date that is 1 year after the
date of enactment of this Act.
<all>