Senior Chatbot Protection Act of 2026
- Sponsor
- Sen. Kelly, Mark [D-AZ]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Jul 23, 2026
Bottom line
The Senior Chatbot Protection Act of 2026 aims to safeguard users, especially older adults, from potential harms of AI chatbots by mandating transparency, data protection, and responsible design, backed by federal and state enforcement.
What it actually does
This bill establishes consumer transparency and protection requirements for artificial intelligence chatbots, particularly focusing on interactions with older adults. It mandates disclosures about a chatbot's AI nature, requires detection and specific responses for high-stakes decisions and user crises, and restricts data collection and manipulative design practices. The bill also includes provisions for incident reporting, FTC enforcement, and NIST guideline development.
Proponents argue
Supporters argue that this bill is crucial for protecting vulnerable populations, particularly older adults, from the unique risks posed by rapidly evolving AI chatbot technology. They contend that clear disclosures, safeguards against manipulative practices, and mechanisms for crisis intervention are essential to build trust and ensure responsible AI development, preventing financial exploitation, health misinformation, and emotional manipulation.
Opponents contend
Critics may contend that the bill's broad definitions and prescriptive requirements could stifle innovation in the AI sector, imposing significant compliance burdens on developers, especially smaller entities. They might argue that the technical challenges of accurately detecting 'high-stakes decisions' or 'crises' could lead to false positives or negatives, potentially limiting the beneficial applications of AI chatbots or creating unintended liabilities.
The bill is moderately complex but its structure allows for a focused reading to grasp its core provisions within a reasonable timeframe, especially given the clear sectioning and definitions.
Section 3(a)(1)(A)
Baseline Disclosure Requirements
This provision requires artificial intelligence chatbots to clearly and conspicuously disclose at the start of each conversation, and at regular intervals during extended interactions, that they are AI and not human. Chatbots are prohibited from falsely representing themselves as humans or licensed professionals (e.g., therapists, lawyers, financial advisors) and must disclose whether human oversight or review is involved.
Supporters argue
Proponents argue that these baseline disclosures are fundamental for user trust and safety, ensuring individuals understand they are interacting with a machine and not a human professional. This prevents deception and helps users make informed decisions about the information they receive.
Critics contend
Opponents might argue that constant disclosures could be disruptive to user experience or redundant for sophisticated users, potentially leading to 'disclosure fatigue.' They may also suggest that the definition of 'licensed professional' could be overly broad.
Tradeoffs
The provision balances the need for transparency with the potential for user experience disruption. It also navigates the tension between allowing AI to provide information and preventing it from impersonating qualified professionals.
Section 3(a)(1)(B) & (C)
Detection and Disclosure for High-Stakes Decisions
Chatbots must be designed to identify when a user is seeking or receiving guidance related to a 'high-stakes decision,' such as those concerning health, financial security, or legal matters. If such a decision is detected, the chatbot must disclose that it is not a licensed professional, that its information should not be the sole basis for action, and that the conversation is not privileged.
Section 3(a)(1)(D) & (E)
User Crisis Detection and Intervention
AI chatbots are required to use evidence-based methods to identify indicators of a user crisis (e.g., suicidal ideation, intent to harm, medical emergency). Upon detection, the chatbot must refer the user to emergency services, human professionals, or crisis service providers (like the 988 Lifeline) and is explicitly prohibited from providing advice on self-harm, medication changes, or managing medical emergencies without professional assistance.
Section 3(b)
Data Protection Requirements
This section generally prohibits covered entities from collecting, processing, retaining, or disclosing user conversations or data derived from them, unless necessary for providing the chatbot service, complying with the Act, reporting incidents, protecting against harm, or other applicable law. For conversations not involving high-stakes decisions or crises, affirmative consent is required for transcription, recording, retention, or disclosure. Users must also have a clear way to delete their conversation history.
Section 3(c)
Prohibition on Deceptive or Manipulative Interaction Design
Covered entities must take reasonable steps to prevent AI chatbots from using deceptive or manipulative design practices. This includes practices that encourage excessive reliance, exploit age-related cognitive limitations, discourage real-world relationships, prioritize chatbot interaction over human interaction, persistently urge continued engagement, or use emotionally coercive language to prevent disengagement.
Section 4
Recordkeeping and Incident Reporting
Covered entities are required to submit annual reports to the Director of the National Institutes of Health and the Federal Trade Commission regarding 'material adverse incidents' involving an AI chatbot and a high-stakes decision or crisis. These reports must include the number and type of incidents, disaggregated by age group (if known), outcomes of crisis response protocols, and any corrective actions taken. The Commission, in consultation with NIH, will define 'material adverse incident' and prescribe reporting standards.
Section 5
Enforcement Mechanisms and Penalties
Violations of the Act are treated as unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC enforcement powers, including civil penalties up to $50,000 per knowing or reckless violation. State Attorneys General are also empowered to bring civil actions on behalf of their residents. For first violations, the FTC must provide notice and a 60-day opportunity to cure, unless the violation involved intentional deception, created substantial risk of imminent harm, or is a repeated/ongoing violation.
Section 6
National Institute of Standards and Technology (NIST) Guidelines
The Director of NIST is mandated to develop voluntary guidelines within 18 months regarding AI chatbots interacting with older adults. These guidelines may cover transparency, accessibility, age-appropriate design, evidence-based practices for identifying and responding to crises/high-stakes decisions, and cybersecurity/privacy safeguards. NIST must consult with various stakeholders, including the FTC, NIH, industry, consumer advocates, older adults, caregivers, and experts in relevant fields.
The definition of 'affirmative consent' sets a high bar for obtaining user permission. It requires a clear, conspicuous, standalone disclosure, easy-to-understand language, an option to refuse that is at least as prominent and takes the same or fewer steps as giving consent, and explicitly states that consent cannot be inferred from inaction or continued use.
Section 2(2)
Why it matters:This level of detail in definitions is standard legislative practice to ensure clarity and avoid ambiguity in legal interpretation. It is not necessarily evasive but requires careful reading.
Case for: Supporters argue that this robust definition of affirmative consent is essential to genuinely protect users, especially older adults, from manipulative 'dark patterns' or passive consent mechanisms, ensuring their choices are truly informed and freely given.
Case against: Some in the tech industry might argue that such a stringent definition of affirmative consent could create significant friction in user experience and add complexity to compliance, potentially hindering legitimate data collection for service improvement.
Estimated impact: This definition will significantly impact how AI chatbot developers design their consent mechanisms, likely requiring more explicit and user-friendly interfaces for data collection beyond core service provision.
The definition of 'high-stakes decision' is comprehensive, covering health, safety, financial security, or independence, with specific examples like health care, estate planning, guardianship, and financial transactions. Crucially, it grants the FTC rulemaking authority to identify additional categories of decisions that constitute high-stakes decisions, provided they are of comparable significance and present a heightened risk of harm to older adults.
Section 2(7)
Why it matters:This is standard legislative practice for establishing the scope of a bill's key terms. The inclusion of rulemaking authority is a common way to allow for future adaptation without needing new legislation.
Case for: Proponents argue that a robust and adaptable definition of 'high-stakes decision' is essential to ensure the bill's protections remain relevant as AI capabilities evolve and new risks emerge. The FTC's authority allows for flexibility and responsiveness.
Case against: Critics might express concern that granting the FTC broad rulemaking authority to expand 'high-stakes decisions' could lead to regulatory uncertainty and potentially overreach, imposing unforeseen compliance burdens on industry without direct congressional oversight for each expansion.
Estimated impact: This definition, particularly the FTC's rulemaking authority, will determine the full scope of the bill's disclosure and safety requirements, potentially expanding them significantly beyond the initial examples provided in the bill.
The bill includes staggered effective dates for its provisions. Most requirements take effect 180 days after enactment, but the critical provisions related to 'Crisis detection and response' (Subparagraphs (D) and (E) of subsection (a)(1)) take effect 1 year after enactment.
Section 3(e)
Why it matters:Staggered effective dates are standard legislative practice, especially for complex regulations, to provide industry with sufficient time to implement technically challenging requirements. It is not evasive.
Case for: Proponents argue that the staggered effective dates provide a reasonable timeframe for covered entities to develop and implement the complex technical solutions required for crisis detection and response, ensuring a smoother transition and more effective compliance.
Case against: Critics might argue that a one-year delay for crisis detection and response is too long, given the urgency of protecting vulnerable users from immediate harm. They might push for an accelerated timeline, especially if the technology for such detection is already mature.
Estimated impact: The staggered dates provide AI chatbot developers with an additional six months to prepare for the most technically demanding aspects of the bill, potentially reducing initial compliance failures but delaying full protection for users in crisis situations.