S. 4407

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4407 Introduced in Senate (IS)]

<DOC>

119th CONGRESS
2d Session
S. 4407

To require the creation of family accounts for children to be able to 
use artificial intelligence chatbots, to require verifiable parental 
consent for teens using artificial intelligence chatbots, and for other 
purposes.

_______________________________________________________________________

IN THE SENATE OF THE UNITED STATES

April 28, 2026

Mr. Cruz (for himself, Mr. Schatz, Mr. Curtis, and Mr. Schiff) 
introduced the following bill; which was read twice and referred to the 
Committee on Commerce, Science, and Transportation

_______________________________________________________________________

A BILL

To require the creation of family accounts for children to be able to 
use artificial intelligence chatbots, to require verifiable parental 
consent for teens using artificial intelligence chatbots, and for other 
purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the ``Children's Health, Advancement, 
Trust, Boundaries, and Oversight in Technology Act'' or the ``CHATBOT 
Act''.

SEC. 2. DEFINITIONS.

In this Act:
(1) Artificial intelligence.--The term ``artificial 
intelligence'' has the meaning given such term in section 5002 
of the National Artificial Intelligence Initiative Act of 2020 
(15 U.S.C. 9401).
(2) Artificial intelligence chatbot.--The term ``artificial 
intelligence chatbot'' means artificial intelligence that, in 
an open-ended natural-language or multimodal manner--
(A) accepts user input;
(B) engages in interactive conversations with a 
user; and
(C) provides outputs that are not--
(i) pre-determined or scripted;
(ii) limited to contextualized replies or 
to a narrow, specified purpose, such as--
(I) customer service;
(II) any operational purpose of a 
business;
(III) productivity and analysis 
related to source information;
(IV) internal research; or
(V) technical assistance; or
(iii) limited to an educational product or 
service that primarily provides information, 
experience, training, or instruction for the 
purpose of building any knowledge, skill, or 
craft.
(3) Child.--The term ``child'' means an individual who is 
under the age of 13.
(4) Commission.--The term ``Commission'' means the Federal 
Trade Commission.
(5) Covered entity.--The term ``covered entity'' means any 
public-facing website, online service, or software application 
that, as its primary function, provides an artificial 
intelligence chatbot to users.
(6) Know.--The term ``know'' means to have actual knowledge 
or knowledge fairly implied on the basis of objective 
circumstances.
(7) Parent.--With respect to a child or teen, the term 
``parent'' includes a legal guardian of the child or teen.
(8) Personal data.--The term ``personal data'' has the 
meaning given the term ``personal information'' in section 1302 
of the Children's Online Privacy Protection Act of 1998 (15 
U.S.C. 6501).
(9) Targeted advertising.--The term ``targeted 
advertising''--
(A) means advertising or any other effort to market 
a product or service to a child or teen user based on 
any personal data collected from the child or teen; and
(B) does not include--
(i) advertising or marketing to a child or 
teen user in response to the most recent prompt 
input by the child or teen user;
(ii) contextual advertising, such as when 
an advertisement is displayed to a child based 
on the content of the website, online service, 
or software application of a covered entity in 
which the advertisement appears and does not 
vary based on the personal data of the child or 
teen user; or
(iii) processing personal data solely for 
the purpose of measuring or reporting 
advertising or content performance, reach, or 
frequency, including independent measurement.
(10) Teen.--The term ``teen'' means an individual who has 
attained 13 years of age but has not attained 18 years of age.
(11) Transparency label.--The term ``transparency label'' 
means a notice that--
(A) is clearly and conspicuously displayed to a 
user;
(B) disappears only if the user--
(i) exits the artificial intelligence 
chatbot; or
(ii) affirmatively dismisses the notice; 
and
(C) discloses that--
(i) the artificial intelligence chatbot is 
artificial intelligence and not a natural 
person; and
(ii) any output of the artificial 
intelligence chatbot is generated using 
artificial intelligence.
(12) User.--The term ``user'' means, with respect to a 
covered entity, an individual who registers an account or 
creates a profile in order to access the artificial 
intelligence chatbot of the covered entity.

SEC. 3. FAMILY ACCOUNT REQUIREMENT FOR CHILDREN; TERMINATION OF 
EXISTING USER ACCOUNTS AND PROFILES; DELETION OF PERSONAL 
DATA.

(a) Creation and Maintenance of Family Accounts.--A covered entity 
shall require an individual to create and maintain a family account 
that meets the requirements described in section 5 to access an 
artificial intelligence chatbot of the covered entity if the covered 
entity knows such individual is a child.
(b) Termination of Existing User Accounts and Profiles of Child and 
Teen Users.--A covered entity shall terminate any user account or 
profile of an artificial intelligence chatbot of the covered entity 
that exists as of the effective date of this Act if the covered entity 
knows such user is--
(1) a child and such child has not created a family 
account; or
(2) a teen and the parent of such teen has not provided 
verifiable parental consent pursuant to section 4(a)(1).
(c) Deletion of Personal Data of Children and Teens.--
(1) In general.--Subject to paragraph (2), upon termination 
of a user account or profile pursuant to subsection (b), a 
covered entity shall immediately delete all personal data 
collected from the user or submitted by the user (including 
data of the user collected from or submitted by the parent of 
such user) to the artificial intelligence chatbot of such 
entity.
(2) Access of children and teens to personal data.--During 
the 90-day period beginning on the date on which a covered 
entity terminates a user account or profile pursuant to 
subsection (b), to the extent technically feasible and not in 
violation of any licensing agreement, the covered entity shall 
make available to such user or parent of such user, upon 
request, a copy of the personal data collected from the user or 
submitted by the user to the artificial chatbot of such entity 
in--
(A) a manner that is readable and able to be 
understood by a reasonable person; and
(B) a portable, structured, and machine-readable 
format.
(3) Rule of construction.--Nothing in this subsection shall 
be construed to prohibit a covered entity from retaining--
(A) a record of the termination of a user account 
or profile; and
(B) the minimum information necessary for ensuring 
compliance with this section.

SEC. 4. VERIFIABLE PARENTAL CONSENT AND OPTION FOR FAMILY ACCOUNTS FOR 
TEENS.

(a) In General.--
(1) Notice and verifiable parental consent.--Prior to an 
individual's creation of a user account or profile with an 
artificial intelligence chatbot of a covered entity, if the 
covered entity knows such individual is a teen, the covered 
entity shall--
(A) provide direct notice to a parent of the teen 
of the attempt by such teen to create such user account 
or profile; and
(B) obtain verifiable parental consent (as defined 
in section 1302(9) of the Children's Online Privacy 
Protection Act (15 U.S.C. 6501(9))) from the parent of 
the teen in order for the teen to create such user 
account or profile.
(2) Option for family accounts.--In obtaining verifiable 
parental consent under paragraph (1), a covered entity shall 
provide a parent of a teen with the option to create a family 
account for the teen that meets the requirements described in 
section 5.
(3) Default features.--
(A) In general.--Subject to subparagraph (B), if 
the parent of a teen user does not create a family 
account for the teen as permitted in paragraph (2), a 
covered entity shall set and fix any feature or setting 
described in section (5)(a)(1) at the default setting 
required by section 5(b)(1) for the user account or 
profile of such teen.
(B) Later creation of a family account.--If a 
parent of a teen user creates a family account for the 
teen user after such teen user first creates a user 
account or profile, the covered entity shall permit 
such parent to adjust any default setting set and fixed 
under subparagraph (A).
(4) Reasonable efforts.--A covered entity shall be deemed 
compliant with the requirements of this subsection if the 
covered entity is in compliance with the requirements of the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 
6501 et seq.) to use reasonable efforts (taking into 
consideration available technology) to provide a parent with 
direct notice and to obtain verifiable parental consent.
(b) Revocation of Consent.--
(1) In general.--With respect to a parent of a teen who has 
provided verifiable parental consent under subsection (a)(1), a 
covered entity shall provide such parent with the ability to 
revoke such consent.
(2) Effect of verifiable parental consent.--If a covered 
entity receives a revocation of verifiable parental consent 
under paragraph (1), the covered entity shall suspend, delete, 
or otherwise disable the user account or profile of the teen on 
the artificial intelligence chatbot that is subject to such 
revocation.
(c) Rule of Construction.--Nothing in this section shall be 
construed to require a covered entity to require a teen or the parent 
of such teen to provide government-issued identification for--
(1) relationship verification; or
(2) the provision of verifiable parental consent under 
subsection (a)(1).

SEC. 5. PARENTAL CONTROLS AND SETTINGS FOR FAMILY ACCOUNTS.

(a) Parental Controls and Settings.--Any family account provided by 
a covered entity to meet the requirements of section 3 or 4 shall 
permit the parent of a child or teen user, as applicable, to--
(1) determine the privacy and account settings for the user 
account or profile of such child or teen, including the ability 
to--
(A) limit the amount of time the child or teen is 
able to spend using the artificial intelligence chatbot 
of the covered entity;
(B) disable rewards or incentives, including badges 
or other visual award symbols, based on frequency, time 
spent, or the activity of the child or teen using the 
artificial intelligence chatbot;
(C) disable notifications and push alerts;
(D) disable any financial transaction made 
available while using the artificial intelligence 
chatbot;
(E) disable the generation of an output from the 
artificial intelligence chatbot that is not in response 
to the input of a user; and
(F) enable a requirement that the covered entity 
display a transparency label and set the intervals at 
which the transparency label should be displayed;
(2) set the number of inputs that, or the period of time 
during which, an artificial intelligence chatbot may use the 
personal data of, or such inputs provided by, a child or teen 
user to generate outputs before such data and such inputs must 
be deleted from any memory used by the artificial intelligence 
chatbot to generate outputs;
(3) access--
(A) a full record of the conversations and activity 
of the child or teen with such artificial intelligence 
chatbot; and
(B) features that allow the parent to monitor, 
analyze, and understand, at scale, the record of such 
conversations and activity; and
(4) receive customized notifications or other alerts when 
the child or teen attempts to bypass, disable, or violate any 
parental control or setting described in paragraph (1).
(b) Default Safeguards and Parental Control Options.--
(1) Default safeguards.--Each covered entity shall ensure 
that the default setting of any parental control or setting 
described in subsection (a) for a family account is the option, 
or pre-set option (for purposes of paragraph (2)), that 
provides the most protective level of control with respect to 
the use of the artificial intelligence chatbot by a child or 
teen user.
(2) Pre-set options for parents.--Each covered entity shall 
provide a parent of a child or teen user with the option to 
select between several pre-set tiered options for governing the 
settings described in subsection (a)(2) that balance the 
tradeoffs between the protectiveness to the child or teen user 
and the effectiveness of the artificial intelligence chatbot.
(c) Disclosure and Transparency.--
(1) In general.--Each covered entity shall ensure that the 
default setting of any parental control or setting described in 
subsection (a) within a family account is accompanied by a 
clear and conspicuous disclosure that defines the scope of the 
setting in a manner that is understandable by an ordinary 
consumer.
(2) Provision of information.--Prior to the creation of a 
family account, a covered entity shall provide to the parent of 
a child or teen clear and conspicuous information, which may 
include a link to a web page of the covered entity, regarding--
(A) the policies and practices of the covered 
entity with respect to each parental control or setting 
described in subsection (a), including an easy-to-
understand explanation of the options described in such 
subsection, the pre-set options described in subsection 
(b)(2), and the effect of each option or pre-set 
option; and
(B) how to access and manage the family account for 
the child or teen user, including an easy-to-understand 
explanation of how to view, change, and determine each 
parental control or setting described in subsection 
(a).
(d) Report.--A covered entity shall provide an easily accessible 
means for a child or teen user or the parent of such child or teen user 
to--
(1) report violations of the parental controls or settings 
specified in subsection (a); and
(2) contact the covered entity with respect to any matter 
related to child or teen use of the artificial intelligence 
chatbot of the covered entity.

SEC. 6. PROHIBITION ON TARGETED ADVERTISING.

(a) In General.--A covered entity shall not use the personal data 
of a user that the covered entity knows is a child or teen for purposes 
of targeted advertising.
(b) Rule of Construction.--Nothing in subsection (a) shall be 
construed to prohibit a covered entity that knows the age of the child 
or teen from delivering advertising or marketing that--
(1) complies with the prohibition described in subsection 
(a); and
(2) is age-appropriate and intended for a child or teen 
audience, so long as the covered entity does not use any 
personal information other than the age of the child or teen to 
display such advertisement.

SEC. 7. DETERMINATION OF WHETHER A COVERED ENTITY KNOWS THAT AN 
INDIVIDUAL IS A CHILD OR TEEN.

(a) Rule of Construction.--For purposes of determining whether a 
covered entity knows that an individual is a child or teen, the 
Commission or attorney general of a State shall rely on competent and 
reliable evidence, taking into account the totality of circumstances, 
including whether a reasonable and prudent person under the 
circumstances would have known that the individual is a child or teen.
(b) Protections for Privacy.--Nothing in this Act, including a 
determination described in subsection (a), shall be construed to 
require a covered entity to--
(1) implement an age gating or age verification 
functionality; or
(2) affirmatively collect any personal data with respect to 
the age of any individual that the covered entity is not 
already collecting in the normal course of business.
(c) Restriction on Use and Retention of Personal Data.--If a 
covered entity (or a third party acting on behalf of a covered entity) 
voluntarily collects personal data for the purpose of complying with 
this Act, the covered entity (or third party) shall not--
(1) use any personal data collected for a purpose other 
than for sole compliance with the requirements of this Act; or
(2) retain any personal data collected for longer than is 
necessary to comply with the requirements of this Act or than 
is minimally necessary to demonstrate such compliance.

SEC. 8. ENFORCEMENT.

(a) Enforcement by the Commission.--
(1) Unfair or deceptive acts or practices.--A violation of 
this Act shall be treated as a violation of a rule defining an 
unfair or deceptive act or practice prescribed under section 
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Commission shall enforce this 
Act in the same manner, by the same means, and with the 
same jurisdiction, powers, and duties as though all 
applicable terms and provisions of the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.) were incorporated 
into and made a part of this Act.
(B) Privileges and immunities.--Any person who 
violates this Act shall be subject to the penalties and 
entitled to the privileges and immunities provided in 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.).
(C) Authority preserved.--Nothing in this Act shall 
be construed to limit the authority of the Commission 
under any other provision of law.
(b) Enforcement by States.--
(1) Authorization.--Subject to paragraph (3), in any case 
in which the attorney general of a State has reason to believe 
that an interest of the residents of the State has been or is 
threatened or adversely affected by the engagement of a covered 
entity in a practice that violates section 3 or 4, the attorney 
general of the State may, as parens patriae, bring a civil 
action against the covered entity on behalf of the residents of 
the State in an appropriate district court of the United States 
to--
(A) enjoin such practice;
(B) enforce compliance with this Act;
(C) on behalf of residents of the State, obtain 
damages, restitution, or other compensation, each of 
which shall be distributed in accordance with State 
law; or
(D) obtain such other relief as the court may 
consider to be appropriate.
(2) Rights of the commission.--
(A) Notice to the commission.--
(i) In general.--Except as provided in 
clause (ii), before initiating a civil action 
under paragraph (1), the attorney general of a 
State shall provide to the Commission a written 
notice of such action and a copy of the 
complaint for such action.
(ii) Exception.--If the attorney general 
determines that it is not feasible to provide 
the notice described in clause (i) before 
initiating a civil action under paragraph (1), 
the attorney general shall provide written 
notice of the action and a copy of the 
complaint to the Commission immediately upon 
initiating the civil action.
(B) Intervention by the commission.--Upon receiving 
the notice required under subparagraph (A), the 
Commission may--
(i) intervene in the civil action that is 
the subject of the notice; and
(ii) upon intervening--
(I) be heard with respect to any 
matter that arises in such action; and
(II) file a petition for appeal for 
any decision in such action.
(3) Investigatory powers.--Nothing in this subsection may 
be construed to prevent the attorney general of a State from 
exercising the powers conferred on the attorney general by the 
laws of the State to--
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the 
production of documentary or other evidence.
(4) Preemptive action by the commission.--In any case in 
which an action is instituted by or on behalf of the Commission 
for a violation of this Act, no State may, during the pendency 
of that action, institute a separate civil action under 
paragraph (1) against any defendant named in the complaint in 
the action instituted by or on behalf of the Commission for 
that violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1) 
may be brought in--
(i) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or
(ii) another court of competent 
jurisdiction.
(B) Service of process.--In an action brought under 
paragraph (1), process may be served in any district in 
which the defendant--
(i) is an inhabitant; or
(ii) may be found.

SEC. 9. RELATIONSHIP TO OTHER LAWS.

(a) In General.--Subject to subsection (b), the provisions of this 
Act shall preempt any related State law, rule, or regulation only to 
the extent that such State law, rule, or regulation conflicts with a 
provision of this Act.
(b) Rules of Construction.--Nothing in this Act shall be construed 
to--
(1) prohibit a State from enacting a law, rule, or 
regulation that provides greater protection to children than 
the protections provided in this Act; or
(2) affect the application of--
(A) section 444 of the General Education Provisions 
Act (20 U.S.C. 1232g, commonly known as the ``Family 
Educational Rights and Privacy Act of 1974'') or other 
Federal or State laws governing student privacy; or
(B) the Children's Online Privacy Protection Act of 
1998 (15 U.S.C. 6501 et seq.) or any rule or regulation 
promulgated under such Act.

SEC. 10. STUDY ON THE IMPACT OF ARTIFICIAL INTELLIGENCE CHATBOTS ON 
CHILD AND TEEN HUMAN RELATIONSHIPS AND SOCIAL NEEDS.

(a) In General.--Not later than 2 years after the date of enactment 
of this Act, the Director of the National Science Foundation shall 
conduct or commission a study on the effects of artificial intelligence 
chatbots on human relationships and the social needs of children and 
teens.
(b) Scope.--The study required under subsection (a) shall examine, 
with respect to children and teens--
(1) the use of artificial intelligence chatbots by children 
and teens to meet companionship or social needs and the 
resulting effects on the real-world social engagement and 
mental health of children and teens;
(2) the prevalence and effects of sycophantic or 
excessively affirming behavior by artificial intelligence 
chatbots on children and teens; and
(3) the role of design features of artificial intelligence 
chatbots in shaping the results of paragraphs (1) and (2).
(c) Methodology.--The study required under subsection (a) shall 
draw on existing research, expert consultation, and, where feasible, 
observational, experimental, and survey-based data collection, 
consistent with applicable ethical standards and requirements for 
research involving children and teens.
(d) Report.--Not later than 1 year after the date of enactment of 
this Act, the Director of the National Science Foundation shall submit 
to the Committee on Commerce, Science and Transportation of the Senate 
and the Committee on Energy and Commerce and the Committee on Science, 
Space, and Technology of the House of Representatives a report 
containing the findings of the study conducted under subsection (a).

SEC. 11. GAO REPORT ON RECOMMENDATIONS AND BEST PRACTICES.

(a) In General.--Not later than 2 years after the date described in 
section 12, the Comptroller General of the United States (in this 
section referred to as the ``Comptroller General'') shall submit a 
report to the Committee on Commerce, Science, and Transportation of the 
Senate and the Committee on Energy and Commerce and the Committee on 
Science, Space, and Technology of the House of Representatives that 
examines--
(1) the effectiveness of this Act, including the overall 
effectiveness of the family account requirements described in 
sections 3, 4, and 5;
(2) the adoption rate of family accounts by parents of 
children and teens;
(3) the rate of compliance with the requirements of this 
Act by covered entities;
(4) the effectiveness of each parental control or setting 
required within a family account, including recommendations or 
best practices to provide the most protective or ideal level of 
control for children and teens, including analysis of the 
parental control described in section 5(a)(2), including--
(A) using best available research or industry data; 
and
(B) an analysis of model drift with specific 
consideration of the number of inputs or the duration 
of time that causes an artificial intelligence chatbot 
to generate outputs not consistent with its behavior 
parameters;
(5) recommendations for parents and covered entities to 
provide the most protective level of control for children and 
teens with respect to the use of the parental control described 
in section 5(a)(2), including recommended settings for limiting 
the number of inputs or the retention of personal data within 
the memory of the artificial intelligence chatbot, with 
reference to the data described in paragraph (4);
(6) recommendations for parents, based on available data, 
with respect to best practices for maximizing the protection of 
a child or teen within a family account while ensuring the 
effectiveness of an artificial intelligence chatbot;
(7) recommendations to the Commission for improving 
enforcement of this Act; and
(8) recommendations to Congress for potential legislative 
improvement to this Act.
(b) Consultation Requirement.--In carrying out the report required 
under subsection (a), the Comptroller General shall consult with each 
of the following:
(1) The National Institute of Standards and Technology.
(2) The Commission.
(3) Representatives of covered entities.
(4) Parents of children or teen users of artificial 
intelligence chatbots.
(5) Individuals with experience advocating for online child 
safety, consumer protection, or online privacy.
(6) Individuals with experience in artificial intelligence, 
computer science, and software engineering.
(7) Academic experts with expertise in prevention of online 
harms to children or teens.
(8) Other relevant Federal agencies with expertise in child 
or teen online safety.

SEC. 12. EFFECTIVE DATE.

This Act shall take effect on the date that is 1 year after the 
date of enactment of this Act.
<all>