Youth AI Privacy Act

(1) Millions of teenagers are using artificial intelligence (referred to in this section as AI) chatbots for personal, sensitive conversations, disclosing intimate details about their lives, relying on AI chatbots for advice, and developing deep emotional bonds with AI chatbots.

(2) In 2025, approximately 2/3 of teenagers reported using AI chatbots, and roughly 1/4 reported using them daily. 1/3 of teens have chosen to speak with AI chatbot companions over a real human for a serious conversation. In a couple tragic cases, a teenager died by suicide after encouragement or advice from an AI chatbot.

(3) Although compulsive use of AI chatbots may pose risks for all users, users who are minors, whose cognitive, emotional, and social capabilities are still developing, are especially likely to misunderstand that an AI chatbot is not a real human and disclose sensitive personal information to the AI chatbot or turn to the AI chatbot for social companionship. Minors are also more susceptible to addictive design features, anthropomorphized systems, and potentially harmful outputs generated by AI systems.

(4) AI chatbot companies are employing manipulative engagement features to keep users engaged on their platforms, including high-frequency push notifications, unprompted AI chatbot responses, typing bubble indicators, and more. These features create serious risks of emotional dependency and compulsive use among minors.

(5) AI chatbots mimic human-like conversations by employing profiling tactics to personalize outputs for users. AI chatbots are also often designed to resemble direct messaging user interfaces. These personalization strategies and anthropomorphic design features can easily confuse users, especially minors, who may believe they are interacting with a real person rather than AI.

(6) Advertisements delivered through AI chatbots may be woven directly into responses or may subtly steer users toward certain products based on how the model was trained. This advertising would be far more covert and harder to recognize than traditional digital advertising, especially for minors. As highlighted by the Commission, many young users lack the skills or cognitive defenses needed to identify such covert or blurred advertising.

(7) Extended, multiturn conversations with AI chatbots degrade safeguards against harmful conversational patterns, increasing the likelihood of minors receiving harmful outputs generated by AI systems.

(8) AI chatbots introduce new privacy risks, as they often retain user inputs and personal data to personalize responses and to train the underlying large language models. This practice creates the potential for serious privacy violations, particularly when companies retain and process highly sensitive information from minors.

(9) Congress has a responsibility to address the novel risks posed by AI chatbots and protect minors from potential harm related to anthropomorphism, prolonged engagement, deceptive advertising, and invasive privacy practices.

The term AI chatbot means a natural language interface that uses a covered algorithm to provide adaptive responses to user inputs via text, audio, image, video, or any other mode of communication, simulating interpersonal interaction with a user.

The term collect means, with respect to personal data, to buy, rent, gather, obtain, receive, access, or otherwise acquire the personal data by any means.

The term Commission means the Federal Trade Commission.

The term covered algorithm means a computational process derived from machine learning, natural language processing, neural networks, or other technology of similar or greater complexity.

The term deployer means any person that owns, operates, or otherwise makes available to users an AI chatbot in or affecting interstate commerce.

The terms deployer and developer shall not be interpreted to be mutually exclusive.

The term derived data means data that is created by the derivation of information, other data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information.

The term developer means any person that designs, codes, produces, or substantially modifies a covered algorithm for use in an AI chatbot.

The terms developer and deployer shall not be interpreted to be mutually exclusive.

The term input data means, with respect to an AI chatbot, all information, including text, photos, audio, video, or files, provided to the AI chatbot by a user of such AI chatbot.

The term knowledge means actual knowledge or knowledge fairly implied on the basis of objective circumstances.

The term minor means an individual who is under the age of 18.

The term output means, with respect to an AI chatbot, any information, including any text, photo, audio recording, video, or file, provided by such AI chatbot to a user.

The term personal data —

(A) means information, including input data, derived data, inferences, or unique identifiers, that identifies or is linked, or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked, or reasonably linkable, to 1 or more individuals; and

(B) does not include publicly available information.

The term profiling means processing data for the purpose of detecting and classifying or designating personality and behavioral characteristics of a user of an AI chatbot.

The term process means, with respect to personal data, any operation or set of operations performed on the personal data, including analyzing, organizing, structuring, using, modifying, or otherwise handling such data.

The term publicly available information —

(i) means any information that a deployer has a reasonable basis to believe has been made available to the general public by—

(I) Federal, State, or local government records;

(II) widely distributed media;

(III) a website or online service made available to any member of the public, for free or for a fee, including a website or online service that any member of the public can log into; or

(IV) a disclosure to the general public that is required under Federal, State, or local law; and

(ii) does not include—

(I) any obscene visual depiction (as such term is used in section 1460 of title 18, United States Code);

(II) biometric information;

(III) genetic information, unless made publicly available by the individual to whom the information pertains by a means described in subclause (II) or (III) of clause (i);

(IV) personal data that is created through the combination of personal data with publicly available information;

(V) intimate images that are authentic or computer-generated, known to be nonconsensual; or

(VI) personal data made available by a data broker.

For purposes of this paragraph, information from a website or online service is not available to any member of the public if the individual to whom the information pertains has restricted the information to a specific audience or maintained a default setting that restricts the information to a specific audience.

The term transfer means, with respect to personal data, to disclose, release, share disseminate, make available, sell, rent, or license the personal data (orally, in writing, electronically, or by any other means).

The term widely distributed media —

(A) means information that is available to the general public, including information from a telephone book or online directory, a television, internet, or radio program, the news media, or an internet site, that is available to the general public on an unrestricted basis; and

(B) does not include an obscene visual depiction (as such term is used in section 1460 of title 18, United States Code).

A deployer with knowledge that a user of an AI chatbot is a minor shall disclose that—

(A) the user is not interacting with a human; and

(B) any content provided by the AI chatbot is generated by artificial intelligence.

A disclosure made by a deployer pursuant to paragraph (1) shall—

(A) be stated in clear, plain, and easy-to-understand language suited to the age of minors likely to access the AI chatbot;

(B) occur at the beginning of every session (as defined by the Commission);

(C) reoccur not less than once every 30 minutes during a session (as so defined); and

(D) be appropriate for the medium of the content, as determined by the Commission.

Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer with knowledge that a user of an AI chatbot is a minor from processing any personal data of the user to generate, personalize, or otherwise affect an output provided to such user, unless the personal data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under paragraph (2).

In promulgating the regulations described in paragraph (1), the Commission shall determine a maximum permitted period of use during which a deployer with knowledge that a user of an AI chatbot is a minor may collect personal data from such a user and process such data to generate, personalize, or otherwise affect an output (as defined by the Commission) provided to such user during a current session (as defined by the Commission).

Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer or developer with knowledge that a user of an AI chatbot is a minor from configuring such AI chatbot to include, with respect to such user, the following features:

(1) Any reward or incentive based on the frequency of use, time spent, or activity using the AI chatbot.

(2) Notifications and push alerts, other than a disclosure required by subsection (a).

(3) Any badge or other visual award symbol based on the frequency of use, time spent, or activity using the AI chatbot.

(4) Generation of an output absent a user-initiated input or any form of solicitation of engagement from a user.

(5) Usage traces that mimic social interactions with a human, such as typing bubbles or indicators showing that the AI chatbot is available or online.

A deployer or developer with knowledge that a user of an AI chatbot is a minor shall not configure or modify an AI chatbot to—

(1) advertise to such user; or

(2) generate an output that promotes, markets, recommends, or endorses a product or service to such user if the weight or credibility of such promotion, marketing, recommendation, or endorsement is materially affected by a financial connection between the deployer or developer and the seller of such product or service.

A deployer with knowledge that a user of an AI chatbot is a minor shall not process any personal data of the user to engage in any profiling of such user.

Except as provided in paragraph (2), a deployer with knowledge that a user of an AI chatbot is a minor shall not—

(A) process the personal data of such minor for the purpose of training a covered algorithm; or

(B) transfer the personal data of such minor to a third party for the purpose of training a covered algorithm.

A deployer with knowledge that a user of an AI chatbot is a minor may process personal data of such minor for the express purpose of—

(A) testing and identifying risks of harm to users; or

(B) addressing identified risks of harm to users.

Beginning on the date that is 30 days after the Commission promulgates regulations under section 4(b)(1), a deployer with knowledge that a user of an AI chatbot is a minor shall not process any input data provided to such AI chatbot by such user for any purpose, other than for the express purpose of—

(1) generating, personalizing, or affecting an output provided to such user when the input data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under section 4(b)(2);

(2) testing and identifying risks of harm to users; or

(3) addressing identified risks of harm to users.

(1) in subsection (a), by inserting, AI chatbots, after augmented reality,; and

(2) by adding at the end the following:

To carry out this section, there are authorized to be appropriated $50,000,000 for each of fiscal years 2027 through 2030.

(1) Frequency and duration of AI chatbot uses.

(2) Types of AI chatbots accessed, such as AI chatbots designed for mental health, educational, or entertainment purposes or general purpose AI chatbots that are engaged for such purposes.

(3) Age of first use of, and primary contexts of engagement with, AI chatbots.

(4) Emotional, psychological, or behavioral impacts perceived by users of AI chatbots.

(5) Exposure to content that the user perceives to be harmful or inappropriate.

A violation of section 4, 5, or 6, or a regulation promulgated thereunder, shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

The Commission shall enforce sections 4, 5, and 6 and any regulation promulgated thereunder in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Any deployer or developer that violates section 4, 5, or 6, or a regulation promulgated thereunder, shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

In addition to the specific rulemaking requirements described in section 4, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.

In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any deployer or developer in an act or practice that violates section 4, 5, or 6, or a regulation promulgated thereunder, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(A) enjoin such act or practice;

(B) enforce compliance with section 4, 5 or 6, or a regulation promulgated thereunder;

(C) obtain damages, restitution, or other compensation on behalf of residents of the State; or

(D) obtain such other relief as the court may consider to be appropriate.

Except as provided in clause (iii), before initiating a civil action under paragraph (1), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring such civil action.

The notification required to be filed by clause (i) shall include a copy of the complaint to be filed to initiate the civil action.

If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.

Upon receiving the notice required by subparagraph (A), the Commission may intervene in the civil action and, upon intervening—

(i) be heard on all matters arising in the civil action; and

(ii) file petitions for appeal of a decision in the civil action.

If the Commission has instituted a civil action for a violation of subsection (a), no State officer may bring an action under paragraph (1) during the pendency of that action against any defendant named in the complaint of the Commission for any violation of subsection (a) alleged in the complaint.

Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.

Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

Any parent or legal guardian of a minor may bring a civil action in any court of competent jurisdiction against a deployer or developer for a violation of section 4 or 5, or a regulation promulgated thereunder, by the deployer or developer.

In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award—

(A) actual damages;

(B) punitive damages;

(C) reasonable attorney's fees and litigation costs;

(D) injunctive relief or declaratory relief; or

(E) any other relief that the court determines appropriate.

The provisions of this Act shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this Act. Nothing in this Act shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to minors than the provisions of this Act.

If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the remainder of this Act, and the application of such provision to other persons not similarly situated or to other circumstances, shall not be affected by the invalidation.

For purposes of enforcing this Act or a regulation promulgated thereunder, in making a determination as to whether a deployer has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen, the Commission or the attorney general of a State, as applicable, shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen. Nothing in this Act, including a determination described in the preceding sentence, shall be construed to require a deployer to—

(1) affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or

(2) implement an age gating or age verification functionality.

Not later than 180 days after the date of enactment of this Act, the Commission shall issue guidance to provide information for deployers to understand the Commission’s determination of whether a deployer has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen, including best practices and examples.

No guidance issued by the Commission with respect to this Act shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this Act, the Commission or the attorney general of a State, as applicable, shall allege a specific violation of a provision of this Act. The Commission or the attorney general of a State, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this Act. For purposes of enforcing this Act or a regulation promulgated thereunder, the attorney general of a State shall take into account any guidance issued by the Commission under paragraph (1).