CHATBOT Act
- Sponsor
- Sen. Cruz, Ted [R-TX]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Aug 5, 2026
Bottom line
The CHATBOT Act aims to enhance parental control and privacy protections for minors interacting with AI chatbots by requiring family accounts, parental consent, and restricting targeted advertising.
What it actually does
This bill mandates that artificial intelligence (AI) chatbot providers require family accounts for children under 13 and obtain verifiable parental consent for teens aged 13-17 to use their services. It establishes detailed parental controls for these accounts, including usage limits, content monitoring, and disabling features like rewards or financial transactions. The bill also prohibits targeted advertising to children and teens and outlines enforcement mechanisms for the Federal Trade Commission and State Attorneys General.
Proponents argue
Proponents argue that the bill is essential for protecting children and teens from the potential harms of rapidly evolving AI technologies, such as privacy violations, manipulative design, and negative impacts on mental health. They contend it empowers parents to manage their children's online experiences and ensures a safer digital environment for younger users.
Opponents contend
Opponents may argue that the bill imposes significant compliance burdens on AI chatbot developers, potentially stifling innovation and limiting access to beneficial AI tools for educational or creative purposes. Concerns could also be raised about the practicality and privacy implications of age verification methods, as well as the potential for over-regulation in a nascent industry.
The bill is relatively concise and clearly structured, making it accessible for an informed reader to understand its provisions and implications within a reasonable timeframe.
Section 3
Family Account Requirement for Children
This section mandates that covered entities (public-facing AI chatbot providers) require individuals known to be under 13 years old to create and maintain a 'family account' to access their services. It also requires the termination of existing child accounts that do not comply and the deletion of associated personal data, with a 90-day window for parents to request a copy of the data.
Supporters argue
Proponents argue this provision is crucial for protecting young children from inappropriate content, privacy risks, and potential manipulation by AI, ensuring parental supervision from the outset.
Critics contend
Critics may argue that this creates a significant barrier to entry for children who might benefit from AI tools, and that the data deletion requirements could be technically challenging and costly for providers.
Tradeoffs
This provision balances the desire for child safety and parental control against potential restrictions on children's access to technology and increased operational costs for AI providers.
Section 4
Verifiable Parental Consent for Teens
This section requires AI chatbot providers to obtain verifiable parental consent before individuals aged 13 to 17 can create an account. Parents are given the option to create a family account for their teen, which would enable parental controls. If a family account is not chosen, default protective settings must be applied to the teen's account. Parents can also revoke consent, leading to account suspension or deletion.
Section 5
Parental Controls and Settings for Family Accounts
This section details the specific parental controls that must be available within family accounts. These include the ability for parents to limit usage time, disable rewards/incentives, turn off notifications, block financial transactions, disable unsolicited AI outputs, and control the display of transparency labels. Parents can also set limits on how long personal data is used by the chatbot and access full conversation records. Default settings must be the 'most protective' option.
Section 6
Prohibition on Targeted Advertising
This section prohibits covered entities from using the personal data of children or teens for targeted advertising. It clarifies that this does not prevent age-appropriate contextual advertising or advertising based on the most recent user prompt, nor does it prohibit processing data solely for measuring ad performance.
Section 8
Enforcement by FTC and States
This section grants enforcement authority to the Federal Trade Commission (FTC), treating violations of the Act as unfair or deceptive acts or practices under the Federal Trade Commission Act. It also authorizes State Attorneys General to bring civil actions on behalf of their residents to enjoin practices, enforce compliance, or obtain damages, with provisions for notifying and allowing intervention by the FTC.
Section 10
Study on Impact of AI Chatbots on Child and Teen Relationships
This section requires the Director of the National Science Foundation (NSF) to conduct or commission a study within two years of the Act's enactment on the effects of AI chatbots on human relationships and social needs of children and teens. The study's scope includes examining the use of chatbots for companionship, the prevalence of sycophantic AI behavior, and the role of design features.
The definition of 'artificial intelligence chatbot' is highly specific, excluding AI used for customer service, operational purposes, productivity/analysis, internal research, technical assistance, or educational products primarily providing information/training. This significantly narrows the scope of entities covered by the Act.
Section 2(2)
Why it matters:This level of detail in definitions is standard legislative practice to precisely delineate the bill's applicability and avoid unintended consequences for other AI applications.
Case for: Proponents would argue that this precise definition ensures the bill targets the specific interactive, open-ended AI experiences that pose unique risks to children and teens, without burdening other forms of AI that are less problematic or serve essential functions.
Case against: Critics might argue that the exclusions are too broad, potentially allowing some AI applications that still pose risks to minors to escape regulation, or that the distinctions are too fine and could lead to loopholes.
Estimated impact: This definition determines which segment of the AI industry is subject to the Act's requirements, significantly impacting the compliance burden and the scope of protection for minors.
This subsection mandates that the default setting for any parental control or setting within a family account must be the option that provides the 'most protective level of control' for the child or teen user.
Section 5(b)(1)
Why it matters:This is a substantive policy choice embedded within technical implementation details, reflecting a legislative preference for strong default protections.
Case for: Proponents would argue that 'most protective' defaults are essential because many parents may not actively configure settings, ensuring a baseline of safety for all minors using family accounts.
Case against: Some industry groups might argue that 'most protective' defaults could lead to a suboptimal user experience, potentially limiting the beneficial functionalities of AI chatbots for minors by default, and that parents should have more active choice.
Estimated impact: This provision significantly impacts the out-of-the-box experience for minors using AI chatbots under family accounts, leaning heavily towards safety over unrestricted access.
This subsection clarifies that nothing in the Act should be construed to require a covered entity to implement age gating or age verification functionality, or to affirmatively collect any personal data regarding age that is not already collected in the normal course of business.
Section 7(b)
Why it matters:This is a deliberate legislative choice to address industry concerns about privacy and data collection, ensuring that compliance doesn't inadvertently lead to more data collection or burdensome age verification processes.
Case for: Proponents would argue this provision is crucial for protecting user privacy by preventing a mandate for widespread age verification, which could lead to more data collection from all users, including adults.
Case against: Critics might argue that without explicit age verification requirements, it will be difficult for covered entities to reliably 'know' a user's age, potentially undermining the effectiveness of the Act's protections for minors.
Estimated impact: This provision significantly impacts how AI chatbot providers approach age determination, aiming to avoid a universal age verification system while still requiring them to act on 'known' age.