Child AI Safety and Parental Controls

Full Title:
CHATBOT Act

Summary#

This bill would set new rules for how public-facing AI chatbots may be used by children and teens. Its main changes are (1) requiring family accounts and parental controls for children under 13, (2) requiring verifiable parental consent for teens 13–17 before they can create accounts, and (3) banning the use of personal data from known children or teens for targeted advertising. The bill aims to increase child safety, parental control, and transparency around AI chatbots.

Key points:

  • Who is covered: “Covered entities” are public-facing websites, services, or apps whose primary function is to provide an AI chatbot.
  • Family accounts: If a service knows a user is under 13, it must require a family account managed by a parent.
  • Verifiable parental consent for teens: If a service knows a user is 13–17, it must notify the parent and get verifiable parental consent before letting the teen create an account; parents may choose a family account for the teen.
  • Data deletion and portability: Accounts for children or teens that do not meet these rules must be terminated and personal data deleted, though users/parents may request a copy of the data within 90 days if technically feasible.
  • Parental controls: Family accounts must let parents set time limits, disable rewards/notifications/financial transactions, control chatbot memory retention, view full chat records, and get alerts if controls are bypassed. Default settings must be the most protective.
  • Advertising ban: Services cannot use personal data of known children or teens for targeted advertising. Age-only, age-appropriate ads are allowed.
  • Enforcement: The Federal Trade Commission enforces the law as an unfair or deceptive practice. State attorneys general may sue on behalf of residents, with notice to the FTC.
  • Timing and study requirements: The rules start 1 year after enactment. The bill requires an NSF study on chatbots’ effects on children and teens and a later government report examining the law’s effectiveness and best practices.

What it means for you#

  • Parents

    • Must create and manage family accounts for children under 13 to let them use covered chatbots.
    • Will be notified and must give verifiable consent before a teen (13–17) can open a chatbot account.
    • Can set time limits, turn off rewards and notifications, disable in-chat purchases, limit how long the chatbot keeps inputs, see full chat logs, and get alerts if a child tries to bypass controls.
    • Can revoke consent for a teen; the teen’s account must then be suspended, deleted, or disabled.

  • Children (under 13)

    • Cannot use a covered chatbot unless a parent creates a family account for them.
    • Existing child accounts will be terminated if they do not move into family accounts.

  • Teens (13–17)

    • Need a parent’s verifiable consent before creating a chatbot account.
    • If parents do not create a family account, the service must apply the most protective default settings to the teen’s account.
    • Parents can later create a family account and change those settings.

  • Businesses that run chatbots

    • Must identify when users are children or teens (based on “knows” standard using reliable evidence) and enforce family accounts and parental consent rules.
    • Must delete personal data for terminated accounts, with a 90-day window for users/parents to request a portable copy if technically feasible.
    • Cannot use children’s or teens’ personal data for targeted advertising.
    • Must provide parental control features, default to the most protective settings, explain options clearly, and offer reporting tools for violations.
    • Covered entities whose chatbot is only one feature and not the primary function may not be covered; the bill limits coverage to services whose primary function is providing an AI chatbot.

  • Government agencies

    • The FTC will enforce the rules using its existing powers.
    • State attorneys general may sue on behalf of residents.
    • The NSF must study chatbot effects on youth; the Government Accountability Office (GAO) must report on how the law is working.

Expenses#

No direct public cost estimate is provided in the bill text or summary.

Possible costs suggested by the bill’s requirements:

  • Covered entities may face compliance costs to build family-account systems, verifiable parental consent flows, parental control tools, data-deletion and portability features, and ad-targeting changes.
  • The FTC and state attorneys general may incur enforcement and oversight costs.
  • The NSF and GAO will incur research and reporting costs related to the required studies and reports.

If you need exact dollar estimates, no fiscal note or budget estimate is included in the bill text.

Proponents' View#

The bill appears intended to protect children and teens when they use AI chatbots. Possible supportive arguments drawn from the bill text:

  • It could increase parental control and oversight by requiring family accounts and detailed parental settings.
  • It could reduce commercial pressure and profiling of youth by banning targeted advertising based on children’s or teens’ personal data.
  • It requires clear identification that interactions are with AI (transparency labels), which could reduce confusion about whether a user is talking to a person or a machine.
  • It aims to improve knowledge by directing research on how chatbots affect young people’s social needs and relationships and by asking the GAO to evaluate the law’s effectiveness and recommend best practices.

Opponents' View#

The bill’s design raises some practical questions and trade-offs based on its text:

  • One concern is that the definition of “covered entity” is limited to services whose primary function is a chatbot. This may leave many platforms with chat features outside the law, creating patchy protection.
  • The bill relies on whether a service “knows” someone is a child or teen using a totality-of-circumstances test. This could create uncertainty for companies about when the rules apply and how to prove compliance.
  • The requirement that defaults be the “most protective” could reduce the usefulness or effectiveness of chatbots for teens if safety limits restrict features that make chatbots helpful.
  • The bill allows deletion of personal data “to the extent technically feasible” and permits a 90-day data-access window. It is unclear how often technical or licensing limits will prevent full portability or deletion.
  • The provisions on timing for the NSF study are inconsistent: the bill says the NSF must conduct or commission a study within 2 years after enactment, but also requires the NSF to submit a report of findings within 1 year after enactment. This timing conflict is not resolved in the bill text.
  • Compliance and implementation could be costly for smaller companies or services, and the bill does not provide guidance on scaling requirements by company size.