SAFE KIDS Act
- Sponsor
- Sen. Curtis, John R. [R-UT]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jun 23, 2026
Bottom line
The SAFE KIDS Act establishes a comprehensive regulatory framework for AI chatbot providers to protect children online, focusing on age verification, risk mitigation, parental controls, and independent oversight.
What it actually does
This bill, the SAFE KIDS Act, mandates that providers of artificial intelligence (AI) chatbots implement robust child safety measures, including age verification, comprehensive risk assessments, and parental control settings. It prohibits child-targeted advertising and the sale or sharing of children's personal information without verifiable parental consent. Additionally, it requires annual independent audits of AI chatbots to ensure compliance and establishes a crisis-response protocol for child users at risk.
Proponents argue
Supporters argue that this bill is crucial for protecting children from the unique and evolving harms posed by AI chatbots, such as manipulation, exposure to harmful content, and data exploitation. They contend it empowers parents with necessary tools to manage their children's digital interactions and fosters responsible innovation in the AI sector by setting clear safety standards.
Opponents contend
Critics may argue that the bill's stringent requirements, particularly around age verification and independent audits, could stifle innovation, impose significant compliance costs on AI developers, and potentially lead to over-censorship or limited access to beneficial AI tools for children. Concerns might also be raised about the privacy implications of mandatory age estimation technologies.
The bill is moderately detailed, requiring a careful read to understand its technical definitions and extensive requirements, but it is accessible to an informed reader within a reasonable timeframe.
Section 3
Determination of User Age
This section requires AI chatbot providers to treat any user as a child for the purposes of the Act's protections unless they have verified the user is 18 or older. Providers must implement age estimation technology, or use age signals from operating systems/app stores, and periodically review accounts. Data collected for age estimation must be minimally necessary, secured, and not retained longer than needed, or used for other purposes like advertising or AI training.
Supporters argue
Supporters argue that robust age verification is fundamental to ensuring child safety online, preventing minors from accessing inappropriate content or being subjected to manipulative practices. This provision ensures that protections are applied broadly and consistently.
Critics contend
Critics may contend that mandatory age estimation technology is costly, technically challenging, and could raise privacy concerns for all users, including adults. They might also argue it could lead to children being locked out of beneficial AI tools or incentivized to circumvent age gates.
Tradeoffs
This provision balances the need for comprehensive child protection with potential impacts on user privacy, technical feasibility for providers, and the risk of restricting access to AI tools for legitimate users.
Section 4(a)(1) & (2)
Risk Assessments and Mitigation Measures
AI chatbot providers must conduct and document comprehensive risk assessments to identify existing and foreseeable child safety risks before making an AI chatbot available to children, before material updates, and annually. Based on these assessments, providers must implement measures to mitigate identified risks and establish safeguards for child users. The bill specifically prohibits content promoting eating disorders, illegal activities, graphic violence, sexually explicit conduct, child sexual abuse material, or self-harm.
Section 4(a)(4)
Crisis-Response Protocol
This section mandates that AI chatbot providers create and maintain a documented crisis-response protocol for conversations indicating a user is at risk for covered harms like suicidal ideation or self-harm. The protocol must include guardrails to prevent circumvention, timely in-service support, referrals to external crisis resources, and parental notification (via email, text, or push alert) if a child is at imminent risk, unless such notification is deemed not in the child's best interest by the Commission. Data collected for this protocol is strictly limited to crisis detection and response.
Section 4(a)(5)
Prohibiting Manipulation and Deceptive Design; Promoting Critical Thinking
This section requires AI chatbot providers to provide clear, periodic, and age-appropriate notices to child users that they are interacting with an AI system. It prohibits AI chatbots from generating outputs that would reasonably lead a child to believe they are interacting with a human, or outputs designed to promote isolation, inappropriate emotional dependence, discourage breaks, solicit purchases, facilitate advertising, diagnose health, or discourage sharing concerns with trusted adults.
Section 4(a)(7)
Parental Settings Program
AI chatbot providers must create and offer a parental settings program, accessible via browser or app, with easy-to-understand tools linked to a child's account. Minimum features include controls over AI memory use, use of child's personal information for training, interaction preferences, usage limits, feature access, basic interaction information, PIN-protected access, and the ability to disable access for children under 13. Providers must actively promote these settings and notify parents if any parental setting is modified or disabled by someone other than the parent.
Section 5
Advertising and Information Sharing Protections for Children
This section makes it unlawful for AI chatbot providers to advertise to child users, engage in child-targeted advertising (cross-context behavioral advertising), or sell or share children's personal information without verifiable parental consent. It also prohibits conditioning a child's use of an AI chatbot on parental consent for data sharing or on the child disclosing more personal information than reasonably necessary. Finally, it bans deceptive design patterns that mislead or impair a child's or parent's autonomy or ability to use safety features.
Section 7
AI Child Safety Audit
AI chatbot providers are required to undergo annual independent audits of their systems for child safety. These audits must be conducted by qualified, independent auditors with no conflicts of interest, following Commission-established standards for methodology, red-teaming, and effectiveness evaluation. Providers must submit audit reports to the FTC and publish public summaries. The FTC will review reports, publish aggregated findings, and may allow qualified researchers access to anonymized data for academic study, while protecting trade secrets and security information.
Exclusions from the definition of 'AI chatbot' for systems used only for customer service, operational purposes, internal enterprise deployments not intended for minors, or those with limited contextualized replies or narrow specified purposes.
Section 2(2)(B)
Why it matters:Standard legislative practice to precisely define the scope of a bill's applicability and prevent unintended overreach.
Case for: Supporters argue these exclusions prevent over-regulation of specialized AI tools that do not pose the same broad risks to children as general-purpose conversational AI, allowing businesses to continue using AI for internal or specific customer service functions without undue burden.
Case against: Critics might contend that these exclusions could create loopholes, allowing some AI systems to be designed to just barely fit these categories, thereby evading the bill's child safety requirements while still potentially interacting with or impacting minors.
Estimated impact: Significantly narrows the scope of AI systems subject to the bill's extensive requirements, impacting potentially thousands of specialized AI applications.
A rule of construction stating that nothing in the Act requires a provider of an AI chatbot to alter, weaken, bypass, or otherwise modify its cryptographic or security protections to access or disclose the cleartext information of encrypted user content.
Section 2(12)
Why it matters:This is a critical legal clarification intended to prevent misinterpretation of the Act's requirements regarding data access and to protect existing security and privacy standards.
Case for: Proponents argue this ensures the bill does not inadvertently create 'backdoors' or weaken encryption, thereby protecting the privacy and security of all users, including children, and upholding fundamental cybersecurity principles.
Case against: Some might argue that this provision could limit the ability of providers or law enforcement to detect and respond to certain severe harms, such as child sexual abuse material, if the content is truly end-to-end encrypted and inaccessible.
Estimated impact: Reinforces strong encryption practices across AI chatbots, potentially impacting the ability to monitor or intervene in certain types of harmful content within encrypted communications.
An exception to the parental notification requirement in crisis-response protocols, allowing providers to withhold notification if there is a 'reasonable basis, as determined by the Commission, to believe that such notification is not in the best interest of the child.'
Section 4(a)(4)(A)(iii)
Why it matters:This clause addresses a complex ethical dilemma where parental notification might, in rare circumstances, put a child at greater risk (e.g., in cases of abuse or neglect by the parent). It grants the Commission discretion to make such determinations.
Case for: Proponents argue this exception is vital for protecting vulnerable children who might face further harm if their parents are notified of a crisis. It allows for professional judgment and safeguards against situations where parents might be the source of danger.
Case against: Critics might express concern that this provision could undermine parental rights and create a subjective loophole, giving the Commission broad authority to override parental involvement without clear, objective criteria, potentially leading to inconsistent application.
Estimated impact: Grants the Federal Trade Commission significant discretion in determining when parental notification is appropriate in child crisis situations, potentially impacting the rights and safety of a small but highly vulnerable subset of children.
A violation of this Act or its regulations shall be treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act.
Section 8(a)
Why it matters:This is standard legislative drafting to leverage existing enforcement mechanisms and powers of a federal agency (the FTC) rather than creating an entirely new enforcement framework.
Case for: Proponents argue that this streamlines enforcement by granting the FTC its full range of established powers, including civil penalties and injunctive relief, ensuring that violations of the SAFE KIDS Act can be effectively addressed using proven legal tools.
Case against: No specific opposition is typically raised against this mechanism itself, as it's a procedural aspect of enforcement. Opposition would generally focus on the underlying requirements of the bill that lead to violations.
Estimated impact: Grants the Federal Trade Commission broad and established enforcement authority over AI chatbot providers for violations of the Act, significantly enhancing the regulatory teeth of the legislation.