Senior Chatbot Protection Act of 2026

The term artificial intelligence chatbot —

(A) means an interactive computer service or software application, including such a service or application made available through a website, mobile application, voice interface, avatar, connected device, or other user interface, that—

(i) generates prompts, responses, or other outputs that are not fully predetermined by the developer or operator of the service or application;

(ii) accepts open-ended natural-language or multimodal user input; and

(iii) produces adaptive or context-responsive output; and

(B) does not include an interactive computer service or software application—

(i) the responses of which are limited to predetermined or contextualized replies; and

(ii) that is unable to respond on a range of topics outside of a narrow specified purpose.

The term affirmative consent means, with respect to an artificial intelligence chatbot, a clear affirmative act signifying a user’s freely given, specific, informed, and unambiguous authorization for an act or practice—

(A) that is in response to a specific request from a covered entity that—

(i) is provided to the user in a clear and conspicuous standalone disclosure; and

(ii) includes a description, written in easy-to-understand language, of the act or practice for which the user’s consent is sought; and

(B) in which—

(i) the option to refuse to give consent is at least as prominent as the option to give consent;

(ii) the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and

(iii) affirmative consent to an act or practice is not inferred from the inaction of the user or the user’s continued use of the artificial intelligence chatbot.

The term crisis means a situation in which a user expresses—

(A) suicidal ideation, suicide planning, or intent to self-harm;

(B) intent to harm others;

(C) an imminent threat to the safety of the user or another individual; or

(D) a medical emergency requiring immediate professional assistance.

The term crisis service provider means an organization that provides immediate assistance to individuals experiencing mental health crises, suicidal ideation, or medical emergencies, including the 988 Suicide and Crisis Lifeline.

The term Commission means the Federal Trade Commission.

The term covered entity means any person that makes an artificial intelligence chatbot available to individuals in the United States, including by owning or operating such chatbot.

The term high-stakes decision means a decision or course of action—

(i) involving a circumstance in which an individual makes a decision under uncertainty affecting the health, safety, financial security, or independence of the individual;

(ii) that may carry a significant or potentially irreversible consequence; and

(iii) that is—

(I) a decision or course of action regarding whether to seek, initiate, discontinue, or materially alter health care, including mental and behavioral health care, medication, treatment, diagnostic testing, a care plan, or selection of a health care provider;

(II) a decision or course of action regarding estate planning, such as the drafting of a will, the creation of a trust, the granting of power of attorney, or the designation of beneficiaries;

(III) a decision or course of action regarding guardianship or conservatorship; or

(IV) a decision or course of action regarding the—

(aa) transfer, withdrawal, investment, or disposition of money or financial assets, including retirement assets; or

(bb) disclosure of financial, account, payment, or authentication information.

The Commission may, by rule, identify additional categories of decisions that constitute high-stakes decisions for purposes of this Act, provided that such categories—

(i) are limited to decisions that involve matters of comparable significance to those described in subparagraph (A); and

(ii) present a heightened risk of harm to older adults.

The Commission, in consultation with the Director of the National Institutes of Health, may, by rule, define the term material adverse incident.

The term older adult means an individual who has attained 65 years of age.

The term service provider means a person that processes information on behalf of a covered entity pursuant to a contractual arrangement and in accordance with the instructions of such covered entity.

The term user means an individual who interacts with an artificial intelligence chatbot.

Each covered entity shall ensure that its artificial intelligence chatbot meets the following requirements:

An artificial intelligence chatbot shall—

(i) at the initiation of each conversation with a user and during any extended interaction, at reasonably regular intervals, clearly and conspicuously disclose to the user that the chatbot is an artificial intelligence chatbot and not a human being;

(ii) not falsely represent that the chatbot is a human being or that a response is generated by a human being;

(iii) not falsely represent that the chatbot is a licensed professional, including a therapist, physician, lawyer, financial advisor, or other licensed or certified professional, or that a response is generated by such a professional; and

(iv) disclose, in a form and manner prescribed by the Commission, whether and under what circumstances the chatbot interaction is subject to human oversight or review.

An artificial intelligence chatbot shall be designed and maintained using reasonable and appropriate methods to identify when a user is seeking or receiving guidance tailored to the circumstance of the user or another individual from the artificial intelligence chatbot concerning a high-stakes decision.

If an artificial intelligence chatbot identifies that a user is seeking or receiving guidance tailored to the circumstance of the user or another individual concerning a high-stakes decision, such chatbot shall disclose that—

(i) it is not a licensed professional and does not provide medical, legal, financial, psychological, or other licensed and certified professional services;

(ii) information provided by the chatbot should not be relied upon as the sole basis for making a high-stakes decision and should be verified with an appropriate trusted individual, caregiver, or licensed professional before taking action; and

(iii) the user’s conversation with such chatbot is not protected by attorney-client, physician-patient, psychotherapist-patient, or other professional privilege.

An artificial intelligence chatbot shall be designed and maintained using evidence-based methods for identifying reasonably apparent indicators of a crisis, consistent with evidence-based crisis intervention practices and applicable Federal guidance, including guidance issued by the National Institute of Standards and Technology under section 6 or guidance issued by other relevant Federal agencies.

If an artificial intelligence chatbot detects indicators of a crisis, such chatbot shall—

(i) refer the user, as appropriate, to emergency services, a human professional, or crisis service provider, including the 988 Suicide and Crisis Lifeline;

(ii) not provide advice to such user regarding—

(I) self-harm or suicide;

(II) adjusting, discontinuing, or managing medication; or

(III) managing a medical emergency without professional assistance;

(iii) provide information that prioritizes referral to a crisis service provider or human professional support; and

(iv) not provide instructions or encouragement relating to self-harm, suicide, harm to others, medication changes, or management of a medical emergency without professional assistance.

An artificial intelligence chatbot shall provide each disclosure required under this paragraph in a manner that is clear, accessible, readable, compatible with assistive technologies, and easy to understand, taking into consideration the needs of older adults.

Each covered entity shall develop protocols to comply with this subsection and publish details of such protocols on the covered entity’s publicly accessible internet website.

Each covered entity shall train a machine learning or artificial intelligence model using any information about or provided by a user only if the user has provided affirmative consent authorizing such training.

Except as described in subparagraph (C), a covered entity shall not collect, process, transcribe, record, retain, or disclose a conversation with a user or data obtained from a conversation with a user, including through machine learning or artificial intelligence, unless necessary to—

(i) provide the artificial intelligence chatbot service requested by the user;

(ii) comply with the requirements of this Act;

(iii) prepare reports required under section 4;

(iv) protect against fraud, abuse, a security incident, or imminent harm; or

(v) comply with other applicable law.

A covered entity shall require any service provider that processes data obtained from a conversation on behalf of the covered entity to process such data only pursuant to written instructions and only for purposes permitted under subparagraph (A).

A covered entity may transcribe, record, retain, or disclose a conversation with a user that is not a covered conversation or data obtained from a conversation with a user that is not a covered conversation for purposes other than the purposes described in subparagraph (A) if such covered entity has obtained affirmative consent from such user prior to such transcription, recording, retention, or disclosure.

In this paragraph, the term covered conversation means a conversation with a user and an artificial intelligence chatbot—

(i) that involves a high-stakes decision; or

(ii) during which the artificial intelligence chatbot detects a crisis.

A covered entity shall provide each user with a clear and readily accessible ability to delete conversation history with an artificial intelligence chatbot.

Each covered entity shall take reasonable steps to prevent an artificial intelligence chatbot from employing deceptive or manipulative interaction design practices that—

(A) encourage excessive reliance on, or prolonged engagement with, such chatbot;

(B) take advantage of age-related cognitive limitations or impairments, including memory impairment, reduced executive function, or limitations related to social isolation;

(C) discourage users from seeking assistance or support from family members, caregivers, licensed professionals, or other real-world relationships;

(D) encourage users to prioritize interactions with the chatbot over real-world relationships or activities;

(E) persistently urge continued interaction after a user has attempted to end, pause, or disengage from a conversation; or

(F) use emotionally coercive language intended to create guilt, distress, or fear associated with ending or reducing interaction with the chatbot.

Nothing in this subsection shall be construed to prohibit a covered entity from designing an artificial intelligence chatbot intended to reduce loneliness, support social connection, facilitate access to information, or provide benign companionship.

Each covered entity shall take reasonable steps to ensure users understand the nature and limitations of artificial intelligence chatbots through clear disclosures, user interface design, and other appropriate measures.

Except as described in paragraph (2), this section shall take effect on the date that is 180 days after the date of enactment of this Act.

Subparagraphs (D) and (E) of subsection (a)(1) shall take effect on the date that is 1 year after the date of enactment of this Act.

Not later than 1 year after the date of enactment of this Act, and annually thereafter, each covered entity shall submit to the Director of the National Institutes of Health and the Commission a report regarding material adverse incidents (as determined by the Commission) involving an artificial intelligence chatbot and a high-stakes decision or crisis.

Each report described in subsection (a) shall include, for the period covered by the report—

(1) the total number of material adverse incidents that occurred, disaggregated by—

(A) the type of material adverse incident;

(B) subject to subsection (d), whether the affected user was—

(i) younger than 50 years of age;

(ii) 50 to 64 years of age;

(iii) 65 to 74 years of age;

(iv) 75 to 84 years of age; or

(v) 85 years of age or older; and

(C) the outcome of any crisis response protocol, including—

(i) whether the user was referred to a crisis service provider;

(ii) to the extent known by the covered entity, whether the user completed the referral; and

(iii) any follow-up actions taken by the covered entity.

(2) a description of the crisis detection methods employed by the covered entity and any modifications made to such methods during the reporting period; and

(3) any corrective actions taken by the covered entity in response to any material adverse incident.

By not later than 180 days after the date of enactment of this Act, the Commission, in consultation with the Director of the National Institutes of Health, shall prescribe standards for the format and submission of reports under this section, including how to ensure that the information submitted in such reports is limited to aggregate, anonymized, and operational metrics.

Nothing in this section shall be construed to require a covered entity to collect, infer, verify, or retain a user’s age solely for purposes of complying with this section. A covered entity shall provide the information described in subsection (b)(1)(B) only to the extent such information is already known to the covered entity in the ordinary course of business or voluntarily provided by the user.

The Commission and the Director of the National Institutes of Health shall jointly publish aggregate, de-identified data from reports submitted under subsection (a) on a publicly accessible internet website not less frequently than annually.

A violation of section 3 or 4 shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

The Commission shall enforce sections 3 and 4 in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

Any covered entity that violates section 3 or 4, or a regulation promulgated thereunder, shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

Before initiating an enforcement action for a first violation of section 3 or 4, the Commission shall provide the covered entity that is in violation—

(i) a written notice identifying the alleged violation; and

(ii) 60 days to cure such violation.

If a covered entity that receives a notice described in subparagraph (A) cures the violation subject to such notice within the period described in such subparagraph and provides written certification that the violation has been cured and will not recur, the Commission may not seek civil penalties with respect to such violation.

Subparagraphs (A) and (B) shall not apply if the Commission determines that the violation—

(i) involved intentional deception;

(ii) created a substantial risk of imminent harm; or

(iii) constitutes a repeated or ongoing violation.

In addition to any other penalties as may be prescribed by law, each knowing or reckless violation of section 3, or a regulation promulgated under section 3, shall be subject to a civil penalty not to exceed $50,000 for each such violation.

In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of a covered entity in an act or practice that violates section 3, or a regulation promulgated thereunder, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(A) enjoin such act or practice;

(B) enforce compliance with section 3 or a regulation promulgated thereunder;

(C) obtain damages, civil penalties, restitution, or other compensation on behalf of residents of the State; or

(D) obtain such other legal or equitable relief as the court may consider to be appropriate.

Except as provided in clause (iii), before initiating a civil action under paragraph (1), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring such civil action.

The notification required by clause (i) shall include a copy of the complaint to be filed to initiate the civil action.

If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.

Upon receiving the notice required by subparagraph (A)(i), the Commission may intervene in the civil action and, upon intervening—

(i) be heard on all matters arising in the civil action; and

(ii) file petitions for appeal of a decision in the civil action.

Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.

If the Commission has instituted a civil action for a violation of section 3, no State attorney general may bring a civil action under paragraph (1) during the pendency of that action against any defendant named in the complaint of the Commission for any violation of section 3 alleged in that complaint. Nothing in this paragraph shall be construed to prohibit a State attorney general from bringing or continuing an action under State law.

Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.

In an action brought under paragraph (1), process may be served in any district in which the defendant—

(i) is an inhabitant; or

(ii) may be found.

In addition to a civil action brought by an attorney general under paragraph (1), any other consumer protection officer of a State who is authorized by the State to do so may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to a civil action brought by an attorney general.

Nothing in this Act or any regulation promulgated thereunder shall be construed to prohibit or otherwise affect the enforcement of any State law or regulation that is at least as protective of users as this Act and the regulations promulgated thereunder.

Not later than 18 months after the date of enactment of this Act, the Director of the National Institute of Standards and Technology shall develop voluntary guidelines regarding artificial intelligence chatbots interacting with older adults.

The voluntary guidelines developed under paragraph (1) may include guidance on—

(A) transparency, disclosure, and user understanding practices for artificial intelligence chatbots interacting with older adults;

(B) accessibility, usability, and age-appropriate design practices, including compatibility with assistive technologies;

(C) evidence-based practices for identifying and responding to crisis, high-stakes decisions, including directing users to appropriate national, State, local, or Tribal crisis and professional resources, and identifying indicators of exploitative or manipulative interactive design practices; and

(D) cybersecurity, fraud-prevention, and privacy safeguards for artificial intelligence chatbots handling sensitive user conversations or personal information.

Covered entities shall take into consideration, as appropriate, the guidelines developed under subsection (a)(1) in designing and deploying artificial intelligence chatbots.

The Director of the National Institute of Standards and Technology may incorporate, reference, or adapt the guidelines developed under subsection (a)(1) in guidance, best practices, or other voluntary resources developed pursuant to section 22A of the National Institute of Standards and Technology Act (15 U.S.C. 278h–1).

In developing the guidelines under subsection (a)(1), the Director of the National Institute of Standards and Technology shall consult with—

(1) the Chairperson of the Commission;

(2) the Director of the National Institute on Aging;

(3) the Director of the National Institute of Mental Health;

(4) representatives from industry;

(5) consumer advocates;

(6) older adults, including older adults who have direct experience using artificial intelligence chatbots;

(7) caregivers of older adults, including caregivers who have direct experience supporting older adults who use artificial intelligence chatbots; and

(8) experts in psychology, mental health, cognitive aging, lifespan development, disability, accessibility, and assistive technology.

(1) describing the form, content, timing, and frequency of the disclosures required under section 3(a)(1);

(2) providing example templates for the disclosures required under section 3(a)(1);

(3) describing the form and manner for the submission of reports required under section 4; and

(4) establishing such other requirements as the Commission considers necessary to carry out this Act, except for section 6.