People-First Chatbot Act
- Sponsor
- Rep. Foushee, Valerie P. [D-NC-4]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Jul 9, 2026
Bottom line
The People-First Chatbot Act aims to significantly enhance user privacy, safety, and transparency in interactions with AI chatbots through stringent data handling rules, mandatory disclosures, and strong enforcement provisions.
What it actually does
This bill establishes comprehensive data privacy and security requirements for artificial intelligence chatbot providers, including strict prohibitions on processing personal data and chat logs without affirmative consent, especially for minors. It mandates transparency for users, requiring clear disclosure of AI interaction and prohibiting misleading claims. Furthermore, it introduces 'safety by design' requirements, compelling monthly risk assessments for harms like emotional dependence and compulsive usage, and requires disabling harmful features for minors. The bill also imposes disclosure obligations on businesses using AI for customer service and creates robust enforcement mechanisms, including a private right of action and strict liability for injuries caused by chatbots.
Proponents argue
Proponents argue that this bill is a crucial step to protect consumers, particularly children, from the potential harms and privacy infringements associated with rapidly evolving AI chatbot technology. They contend that it ensures individuals have control over their personal data, prevents manipulative design practices, and holds AI providers accountable for the safety and ethical deployment of their products. Supporters emphasize the need for clear federal standards to address the unique challenges posed by AI, such as emotional dependence and the misuse of personal chat data for advertising or training without explicit consent.
Opponents contend
Opponents might contend that the bill's stringent requirements, particularly around affirmative consent for data processing and training, could stifle innovation in the AI sector and impose significant compliance burdens on providers, potentially leading to reduced service quality or availability. They may argue that the broad definitions of 'covered harm,' 'emotional dependence,' and 'compulsive usage,' coupled with strict liability provisions, could expose companies to excessive litigation risk, discouraging the development of new AI applications. Critics might also raise concerns about the feasibility and cost of implementing age verification and disabling specific features for minors, as well as the potential for a fragmented regulatory landscape if state laws are not preempted.
The bill is moderately complex due to its technical definitions and legal enforcement framework, requiring careful reading to grasp the full scope of its impact. An informed reader will need the estimated time to fully evaluate its provisions.
Section 2(a)(1)
Data Privacy and Security Prohibitions
This provision prohibits AI chatbot providers from processing personal data beyond what's needed for an express user request without affirmative consent. It specifically bans using chat logs for advertising, processing data of minors without parental consent, or training AI models on user data without consent. It also forbids profiling beyond express requests, selling chat logs, and retaining them for more than five years, while also prohibiting discrimination against users who refuse consent.
Supporters argue
Proponents argue these prohibitions are essential to protect user privacy and prevent the exploitation of personal data by AI companies. They contend that requiring affirmative consent and restricting data use for advertising or training without permission empowers users and establishes a baseline of ethical AI practices.
Critics contend
Opponents may argue that these strict prohibitions, particularly the broad consent requirements for training data, could significantly hinder AI development and limit the ability of chatbots to improve through learning from user interactions. They might also contend that the five-year retention limit could impede legitimate research or legal compliance.
Tradeoffs
This provision balances user privacy and control against the operational flexibility and data-driven improvement models of AI chatbot providers. It creates a tension between robust data protection and the potential for slower AI innovation or less personalized user experiences.
Section 2(a)(2) & (3)
User Data Access, Deletion, and Security
This section grants users the right to access their chat logs in a portable, readable format upon request and to have their chat logs and personal data deleted. It also prohibits discrimination against users for exercising these rights. Furthermore, it mandates that AI chatbot providers develop and maintain a comprehensive, publicly summarized data security program within 12 months of the Act's enactment.
Section 2(b)
Transparency for Users
This provision prohibits AI chatbot providers from falsely claiming user input data or chat logs are confidential and from implying that AI outputs are endorsed by or equivalent to licensed professionals (healthcare, legal, accounting, financial). It also mandates clear, conspicuous, and explicit notice that a user is interacting with an AI chatbot, both at the start of interaction, hourly, and when a user asks if it's a real person. This notice must be accessible to users with disabilities and comply with FTC regulations.
Section 2(c)
Safety by Design: Assessments and Transparency for Harmful Features
This section requires AI chatbot providers to conduct monthly risk assessments for 'covered harm,' 'emotional dependence,' or 'compulsive usage,' using metrics set by the FTC. Providers must make this risk assessment information publicly available quarterly. Crucially, if a provider knows a user is under 18, they must disable any feature or setting that creates an unreasonable risk of these harms for that user, in accordance with FTC rules.
Section 2(d)
Customer Service AI Disclosure and Human Transfer Option
This provision requires any business entity using an artificial intelligence chatbot for customer service communications to disclose this fact at the beginning of each interaction. Crucially, it must also inform the consumer that they can request and be immediately transferred to a human operator who is physically located in the United States, ideally via voice command.
Section 4(c) & (d)
Private Right of Action and Strict Liability for Injury
This section establishes a private right of action, allowing individuals injured by a violation of the Act to sue for actual damages or statutory damages ranging from $10,000 per violation (for data privacy/security) up to $250,000 (for covered harm to minors). It also introduces strict liability, meaning an AI chatbot provider can be held liable for actual damages if a user suffers an injury caused by the chatbot, even if the provider exercised all reasonable care or had no direct contractual relationship with the user.
The definition of 'affirmative consent' is exceptionally strict, requiring a clear affirmative act, specific and informed authorization, and explicitly excluding inference from inaction, acceptance of broad terms, hovering, or agreement obtained through dark patterns or misleading statements. The option to refuse consent must be at least as prominent and take the same or fewer steps as giving consent.
Section 5(2)
Why it matters:While definitions are typically placed in a dedicated section for clarity, the detailed and prescriptive nature of this definition makes it a substantive provision that significantly impacts operational requirements for consent, rather than just a technical clarification. Its strictness could be seen as a deliberate legislative choice to prevent 'dark patterns' in consent acquisition.
Case for: Proponents argue that such a rigorous definition of affirmative consent is vital to ensure genuine user control over their data and to prevent manipulative design practices that trick users into agreeing to data processing. It sets a high bar for ethical data handling.
Case against: Opponents might argue that this definition is overly burdensome and could create significant friction in user experience, leading to lower consent rates and hindering AI model training and personalization. They may contend it's impractical for many online interactions.
Estimated impact: This definition will significantly alter how AI chatbot providers obtain user consent for data processing and training, requiring substantial redesign of user interfaces and consent flows, impacting data collection volumes.
The bill defines 'compulsive usage' as persistent and repetitive AI chatbot use significantly impacting major life activities; 'covered harm' as death, suicide attempt, or psychiatric emergency requiring urgent medical treatment; and 'emotional dependence' as a user relying on an AI chatbot as a primary source of emotional support or social connection, including distress at loss of access or substituting human relationships.
Section 5(8), (9), (12)
Why it matters:While definitions are standard, the specific and novel nature of these terms, particularly 'emotional dependence' and 'compulsive usage,' makes them highly consequential. Their placement in definitions means their full impact on liability and design requirements might not be immediately apparent without cross-referencing.
Case for: Proponents argue these definitions are necessary to address the unique psychological and social risks posed by advanced AI chatbots, particularly their potential to foster unhealthy user behaviors or contribute to mental health crises. They provide a legal basis for holding providers accountable for these specific harms.
Case against: Opponents may argue that these definitions are inherently subjective, difficult to measure objectively, and could lead to inconsistent enforcement and excessive litigation. They might contend that attributing 'emotional dependence' or 'compulsive usage' solely to an AI chatbot, rather than broader user circumstances, is overly simplistic and places an unfair burden on providers.
Estimated impact: These definitions will significantly influence AI chatbot design, requiring providers to implement features and monitoring to mitigate these specific risks, especially for minors, and will be central to any liability claims under the Act.
This section establishes strict liability for AI chatbot providers, allowing a user injured by an AI chatbot to recover actual damages even if the provider exercised all reasonable care in design and distribution, or if there was no direct contractual relationship with the user.
Section 4(d)
Why it matters:Strict liability is a significant legal departure from traditional negligence standards, especially in a rapidly evolving technological field. Its placement here, rather than as a core principle at the beginning, might make it less immediately apparent as a foundational shift in liability for AI products.
Case for: Proponents argue that strict liability is necessary because AI systems can cause harm in ways that are difficult to foresee or prevent, even with reasonable care. They contend that the burden of injury should fall on the entity that creates and profits from the technology, ensuring victims are compensated and incentivizing the highest level of safety.
Case against: Opponents would strongly argue that strict liability is an extreme measure that could cripple AI innovation. They contend it creates an impossible standard for developers, as even perfectly designed and tested AI could theoretically cause an unforeseen injury, making the risk of development too high.
Estimated impact: This provision fundamentally alters the legal landscape for AI chatbot providers, shifting liability from fault-based to outcome-based, potentially leading to increased insurance costs, more conservative AI development, and a higher volume of product liability lawsuits.