[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4199 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 4199
To require entities that make artificial intelligence chatbots
available to minors to implement certain safe design features, and for
other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 25, 2026
Mr. Markey introduced the following bill; which was read twice and
referred to the Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To require entities that make artificial intelligence chatbots
available to minors to implement certain safe design features, and for
other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Youth AI Privacy Act''.
SEC. 2. FINDINGS.
Congress finds the following:
(1) Millions of teenagers are using artificial intelligence
(referred to in this section as ``AI'') chatbots for personal,
sensitive conversations, disclosing intimate details about
their lives, relying on AI chatbots for advice, and developing
deep emotional bonds with AI chatbots.
(2) In 2025, approximately \2/3\ of teenagers reported
using AI chatbots, and roughly \1/4\ reported using them daily.
\1/3\ of teens have chosen to speak with AI chatbot
``companions'' over a real human for a serious conversation. In
a couple tragic cases, a teenager died by suicide after
encouragement or advice from an AI chatbot.
(3) Although compulsive use of AI chatbots may pose risks
for all users, users who are minors, whose cognitive,
emotional, and social capabilities are still developing, are
especially likely to misunderstand that an AI chatbot is not a
real human and disclose sensitive personal information to the
AI chatbot or turn to the AI chatbot for social companionship.
Minors are also more susceptible to addictive design features,
anthropomorphized systems, and potentially harmful outputs
generated by AI systems.
(4) AI chatbot companies are employing manipulative
engagement features to keep users engaged on their platforms,
including high-frequency push notifications, unprompted AI
chatbot responses, typing bubble indicators, and more. These
features create serious risks of emotional dependency and
compulsive use among minors.
(5) AI chatbots mimic human-like conversations by employing
profiling tactics to personalize outputs for users. AI chatbots
are also often designed to resemble direct messaging user
interfaces. These personalization strategies and
anthropomorphic design features can easily confuse users,
especially minors, who may believe they are interacting with a
real person rather than AI.
(6) Advertisements delivered through AI chatbots may be
woven directly into responses or may subtly steer users toward
certain products based on how the model was trained. This
advertising would be far more covert and harder to recognize
than traditional digital advertising, especially for minors. As
highlighted by the Commission, many young users lack the skills
or cognitive defenses needed to identify such covert or
``blurred'' advertising.
(7) Extended, multiturn conversations with AI chatbots
degrade safeguards against harmful conversational patterns,
increasing the likelihood of minors receiving harmful outputs
generated by AI systems.
(8) AI chatbots introduce new privacy risks, as they often
retain user inputs and personal data to personalize responses
and to train the underlying large language models. This
practice creates the potential for serious privacy violations,
particularly when companies retain and process highly sensitive
information from minors.
(9) Congress has a responsibility to address the novel
risks posed by AI chatbots and protect minors from potential
harm related to anthropomorphism, prolonged engagement,
deceptive advertising, and invasive privacy practices.
SEC. 3. DEFINITIONS.
In this Act:
(1) AI chatbot.--The term ``AI chatbot'' means a natural
language interface that uses a covered algorithm to provide
adaptive responses to user inputs via text, audio, image,
video, or any other mode of communication, simulating
interpersonal interaction with a user.
(2) Collect.--The term ``collect'' means, with respect to
personal data, to buy, rent, gather, obtain, receive, access,
or otherwise acquire the personal data by any means.
(3) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(4) Covered algorithm.--The term ``covered algorithm''
means a computational process derived from machine learning,
natural language processing, neural networks, or other
technology of similar or greater complexity.
(5) Deployer.--
(A) In general.--The term ``deployer'' means any
person that owns, operates, or otherwise makes
available to users an AI chatbot in or affecting
interstate commerce.
(B) Rule of construction.--The terms ``deployer''
and ``developer'' shall not be interpreted to be
mutually exclusive.
(6) Derived data.--The term ``derived data'' means data
that is created by the derivation of information, other data,
assumptions, correlations, inferences, predictions, or
conclusions from facts, evidence, or another source of
information.
(7) Developer.--
(A) In general.--The term ``developer'' means any
person that designs, codes, produces, or substantially
modifies a covered algorithm for use in an AI chatbot.
(B) Rule of construction.--The terms ``developer''
and ``deployer'' shall not be interpreted to be
mutually exclusive.
(8) Input data.--The term ``input data'' means, with
respect to an AI chatbot, all information, including text,
photos, audio, video, or files, provided to the AI chatbot by a
user of such AI chatbot.
(9) Knowledge.--The term ``knowledge'' means actual
knowledge or knowledge fairly implied on the basis of objective
circumstances.
(10) Minor.--The term ``minor'' means an individual who is
under the age of 18.
(11) Output.--The term ``output'' means, with respect to an
AI chatbot, any information, including any text, photo, audio
recording, video, or file, provided by such AI chatbot to a
user.
(12) Personal data.--The term ``personal data''--
(A) means information, including input data,
derived data, inferences, or unique identifiers, that
identifies or is linked, or reasonably linkable, alone
or in combination with other information, to an
individual or a device that identifies or is linked, or
reasonably linkable, to 1 or more individuals; and
(B) does not include publicly available
information.
(13) Profiling.--The term ``profiling'' means processing
data for the purpose of detecting and classifying or
designating personality and behavioral characteristics of a
user of an AI chatbot.
(14) Process.--The term ``process'' means, with respect to
personal data, any operation or set of operations performed on
the personal data, including analyzing, organizing,
structuring, using, modifying, or otherwise handling such data.
(15) Publicly available information.--
(A) In general.--The term ``publicly available
information''--
(i) means any information that a deployer
has a reasonable basis to believe has been made
available to the general public by--
(I) Federal, State, or local
government records;
(II) widely distributed media;
(III) a website or online service
made available to any member of the
public, for free or for a fee,
including a website or online service
that any member of the public can log
into; or
(IV) a disclosure to the general
public that is required under Federal,
State, or local law; and
(ii) does not include--
(I) any obscene visual depiction
(as such term is used in section 1460
of title 18, United States Code);
(II) biometric information;
(III) genetic information, unless
made publicly available by the
individual to whom the information
pertains by a means described in
subclause (II) or (III) of clause (i);
(IV) personal data that is created
through the combination of personal
data with publicly available
information;
(V) intimate images that are
authentic or computer-generated, known
to be nonconsensual; or
(VI) personal data made available
by a data broker.
(B) Clarification.--For purposes of this paragraph,
information from a website or online service is not
available to any member of the public if the individual
to whom the information pertains has restricted the
information to a specific audience or maintained a
default setting that restricts the information to a
specific audience.
(16) Transfer.--The term ``transfer'' means, with respect
to personal data, to disclose, release, share disseminate, make
available, sell, rent, or license the personal data (orally, in
writing, electronically, or by any other means).
(17) Widely distributed media.--The term ``widely
distributed media''--
(A) means information that is available to the
general public, including information from a telephone
book or online directory, a television, internet, or
radio program, the news media, or an internet site,
that is available to the general public on an
unrestricted basis; and
(B) does not include an obscene visual depiction
(as such term is used in section 1460 of title 18,
United States Code).
SEC. 4. SAFE DESIGN FEATURES.
(a) Required Disclosures.--
(1) In general.--A deployer with knowledge that a user of
an AI chatbot is a minor shall disclose that--
(A) the user is not interacting with a human; and
(B) any content provided by the AI chatbot is
generated by artificial intelligence.
(2) Content and duration of disclosure.--A disclosure made
by a deployer pursuant to paragraph (1) shall--
(A) be stated in clear, plain, and easy-to-
understand language suited to the age of minors likely
to access the AI chatbot;
(B) occur at the beginning of every session (as
defined by the Commission);
(C) reoccur not less than once every 30 minutes
during a session (as so defined); and
(D) be appropriate for the medium of the content,
as determined by the Commission.
(b) Limitation on the Processing of Personal Data To Provide
Outputs.--
(1) In general.--Not later than 1 year after the date of
enactment of this Act, the Commission shall promulgate
regulations to prohibit a deployer with knowledge that a user
of an AI chatbot is a minor from processing any personal data
of the user to generate, personalize, or otherwise affect an
output provided to such user, unless the personal data was
collected during the current session (as defined by the
Commission) more recently than the maximum permitted period of
use established by the Commission under paragraph (2).
(2) Maximum permitted period of use.--In promulgating the
regulations described in paragraph (1), the Commission shall
determine a maximum permitted period of use during which a
deployer with knowledge that a user of an AI chatbot is a minor
may collect personal data from such a user and process such
data to generate, personalize, or otherwise affect an output
(as defined by the Commission) provided to such user during a
current session (as defined by the Commission).
(c) Exclusion of Features That Encourage Compulsive Use.--Not later
than 1 year after the date of enactment of this Act, the Commission
shall promulgate regulations to prohibit a deployer or developer with
knowledge that a user of an AI chatbot is a minor from configuring such
AI chatbot to include, with respect to such user, the following
features:
(1) Any reward or incentive based on the frequency of use,
time spent, or activity using the AI chatbot.
(2) Notifications and push alerts, other than a disclosure
required by subsection (a).
(3) Any badge or other visual award symbol based on the
frequency of use, time spent, or activity using the AI chatbot.
(4) Generation of an output absent a user-initiated input
or any form of solicitation of engagement from a user.
(5) Usage traces that mimic social interactions with a
human, such as typing bubbles or indicators showing that the AI
chatbot is available or online.
SEC. 5. DATA PRIVACY PROTECTIONS.
(a) Prohibition on Advertising and Promotion.--A deployer or
developer with knowledge that a user of an AI chatbot is a minor shall
not configure or modify an AI chatbot to--
(1) advertise to such user; or
(2) generate an output that promotes, markets, recommends,
or endorses a product or service to such user if the weight or
credibility of such promotion, marketing, recommendation, or
endorsement is materially affected by a financial connection
between the deployer or developer and the seller of such
product or service.
(b) Prohibition on Processing of Personal Data for Profiling.--A
deployer with knowledge that a user of an AI chatbot is a minor shall
not process any personal data of the user to engage in any profiling of
such user.
(c) Prohibition on the Processing or Transferring of Personal Data
To Train a Covered Algorithm.--
(1) In general.--Except as provided in paragraph (2), a
deployer with knowledge that a user of an AI chatbot is a minor
shall not--
(A) process the personal data of such minor for the
purpose of training a covered algorithm; or
(B) transfer the personal data of such minor to a
third party for the purpose of training a covered
algorithm.
(2) Exceptions.--A deployer with knowledge that a user of
an AI chatbot is a minor may process personal data of such
minor for the express purpose of--
(A) testing and identifying risks of harm to users;
or
(B) addressing identified risks of harm to users.
(d) Prohibition on Processing of Input Data.--Beginning on the date
that is 30 days after the Commission promulgates regulations under
section 4(b)(1), a deployer with knowledge that a user of an AI chatbot
is a minor shall not process any input data provided to such AI chatbot
by such user for any purpose, other than for the express purpose of--
(1) generating, personalizing, or affecting an output
provided to such user when the input data was collected during
the current session (as defined by the Commission) more
recently than the maximum permitted period of use established
by the Commission under section 4(b)(2);
(2) testing and identifying risks of harm to users; or
(3) addressing identified risks of harm to users.
SEC. 6. WHISTLEBLOWER PROTECTIONS.
A deployer or developer may not, directly or indirectly, discharge,
demote, suspend, threaten, harass, or otherwise discriminate or
retaliate against an individual for raising a concern regarding a
violation of this Act, reporting or attempting to report a violation of
this Act, or cooperating in any investigation or enforcement proceeding
pursuant to this Act.
SEC. 7. RESEARCH ON THE HEALTH AND DEVELOPMENTAL EFFECTS OF AI CHATBOTS
ON MINORS.
Section 1432 of the Restoring Hope for Mental Health and Well-Being
Act of 2022 (42 U.S.C. 285g-11) is amended--
(1) in subsection (a), by inserting, ``AI chatbots,'' after
``augmented reality,''; and
(2) by adding at the end the following:
``(e) Authorization of Appropriations.--To carry out this section,
there are authorized to be appropriated $50,000,000 for each of fiscal
years 2027 through 2030.''.
SEC. 8. SURVEY INCLUSION REQUIREMENT.
The Secretary of Health and Human Services, acting through the
Director of the Centers for Disease Control and Prevention and in
coordination with the Director of the National Institutes of Health,
shall incorporate questions related to the use, by youth and by adults,
of AI chatbots into national health and behavioral surveys conducted by
the Department of Health and Human Services, including the Household
Pulse Survey and the Youth Risk Behavior Surveillance System of the
Centers for Disease Control and Prevention, including questions
designed to capture the following:
(1) Frequency and duration of AI chatbot uses.