[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4407 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 4407
To require the creation of family accounts for children to be able to
use artificial intelligence chatbots, to require verifiable parental
consent for teens using artificial intelligence chatbots, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
April 28, 2026
Mr. Cruz (for himself, Mr. Schatz, Mr. Curtis, and Mr. Schiff)
introduced the following bill; which was read twice and referred to the
Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To require the creation of family accounts for children to be able to
use artificial intelligence chatbots, to require verifiable parental
consent for teens using artificial intelligence chatbots, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Children's Health, Advancement,
Trust, Boundaries, and Oversight in Technology Act'' or the ``CHATBOT
Act''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given such term in section 5002
of the National Artificial Intelligence Initiative Act of 2020
(15 U.S.C. 9401).
(2) Artificial intelligence chatbot.--The term ``artificial
intelligence chatbot'' means artificial intelligence that, in
an open-ended natural-language or multimodal manner--
(A) accepts user input;
(B) engages in interactive conversations with a
user; and
(C) provides outputs that are not--
(i) pre-determined or scripted;
(ii) limited to contextualized replies or
to a narrow, specified purpose, such as--
(I) customer service;
(II) any operational purpose of a
business;
(III) productivity and analysis
related to source information;
(IV) internal research; or
(V) technical assistance; or
(iii) limited to an educational product or
service that primarily provides information,
experience, training, or instruction for the
purpose of building any knowledge, skill, or
craft.
(3) Child.--The term ``child'' means an individual who is
under the age of 13.
(4) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(5) Covered entity.--The term ``covered entity'' means any
public-facing website, online service, or software application
that, as its primary function, provides an artificial
intelligence chatbot to users.
(6) Know.--The term ``know'' means to have actual knowledge
or knowledge fairly implied on the basis of objective
circumstances.
(7) Parent.--With respect to a child or teen, the term
``parent'' includes a legal guardian of the child or teen.
(8) Personal data.--The term ``personal data'' has the
meaning given the term ``personal information'' in section 1302
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6501).
(9) Targeted advertising.--The term ``targeted
advertising''--
(A) means advertising or any other effort to market
a product or service to a child or teen user based on
any personal data collected from the child or teen; and
(B) does not include--
(i) advertising or marketing to a child or
teen user in response to the most recent prompt
input by the child or teen user;
(ii) contextual advertising, such as when
an advertisement is displayed to a child based
on the content of the website, online service,
or software application of a covered entity in
which the advertisement appears and does not
vary based on the personal data of the child or
teen user; or
(iii) processing personal data solely for
the purpose of measuring or reporting
advertising or content performance, reach, or
frequency, including independent measurement.
(10) Teen.--The term ``teen'' means an individual who has
attained 13 years of age but has not attained 18 years of age.
(11) Transparency label.--The term ``transparency label''
means a notice that--
(A) is clearly and conspicuously displayed to a
user;
(B) disappears only if the user--
(i) exits the artificial intelligence
chatbot; or
(ii) affirmatively dismisses the notice;
and
(C) discloses that--
(i) the artificial intelligence chatbot is
artificial intelligence and not a natural
person; and
(ii) any output of the artificial
intelligence chatbot is generated using
artificial intelligence.
(12) User.--The term ``user'' means, with respect to a
covered entity, an individual who registers an account or
creates a profile in order to access the artificial
intelligence chatbot of the covered entity.
SEC. 3. FAMILY ACCOUNT REQUIREMENT FOR CHILDREN; TERMINATION OF
EXISTING USER ACCOUNTS AND PROFILES; DELETION OF PERSONAL
DATA.
(a) Creation and Maintenance of Family Accounts.--A covered entity
shall require an individual to create and maintain a family account
that meets the requirements described in section 5 to access an
artificial intelligence chatbot of the covered entity if the covered
entity knows such individual is a child.
(b) Termination of Existing User Accounts and Profiles of Child and
Teen Users.--A covered entity shall terminate any user account or
profile of an artificial intelligence chatbot of the covered entity
that exists as of the effective date of this Act if the covered entity
knows such user is--
(1) a child and such child has not created a family
account; or
(2) a teen and the parent of such teen has not provided
verifiable parental consent pursuant to section 4(a)(1).
(c) Deletion of Personal Data of Children and Teens.--
(1) In general.--Subject to paragraph (2), upon termination
of a user account or profile pursuant to subsection (b), a
covered entity shall immediately delete all personal data
collected from the user or submitted by the user (including
data of the user collected from or submitted by the parent of
such user) to the artificial intelligence chatbot of such
entity.
(2) Access of children and teens to personal data.--During
the 90-day period beginning on the date on which a covered
entity terminates a user account or profile pursuant to
subsection (b), to the extent technically feasible and not in
violation of any licensing agreement, the covered entity shall
make available to such user or parent of such user, upon
request, a copy of the personal data collected from the user or
submitted by the user to the artificial chatbot of such entity
in--
(A) a manner that is readable and able to be
understood by a reasonable person; and
(B) a portable, structured, and machine-readable
format.
(3) Rule of construction.--Nothing in this subsection shall
be construed to prohibit a covered entity from retaining--
(A) a record of the termination of a user account
or profile; and
(B) the minimum information necessary for ensuring
compliance with this section.
SEC. 4. VERIFIABLE PARENTAL CONSENT AND OPTION FOR FAMILY ACCOUNTS FOR
TEENS.
(a) In General.--
(1) Notice and verifiable parental consent.--Prior to an
individual's creation of a user account or profile with an
artificial intelligence chatbot of a covered entity, if the
covered entity knows such individual is a teen, the covered
entity shall--
(A) provide direct notice to a parent of the teen
of the attempt by such teen to create such user account
or profile; and
(B) obtain verifiable parental consent (as defined
in section 1302(9) of the Children's Online Privacy
Protection Act (15 U.S.C. 6501(9))) from the parent of
the teen in order for the teen to create such user
account or profile.
(2) Option for family accounts.--In obtaining verifiable
parental consent under paragraph (1), a covered entity shall
provide a parent of a teen with the option to create a family
account for the teen that meets the requirements described in
section 5.
(3) Default features.--
(A) In general.--Subject to subparagraph (B), if
the parent of a teen user does not create a family
account for the teen as permitted in paragraph (2), a
covered entity shall set and fix any feature or setting
described in section (5)(a)(1) at the default setting
required by section 5(b)(1) for the user account or
profile of such teen.
(B) Later creation of a family account.--If a
parent of a teen user creates a family account for the
teen user after such teen user first creates a user
account or profile, the covered entity shall permit
such parent to adjust any default setting set and fixed
under subparagraph (A).
(4) Reasonable efforts.--A covered entity shall be deemed
compliant with the requirements of this subsection if the
covered entity is in compliance with the requirements of the
Children's Online Privacy Protection Act of 1998 (15 U.S.C.
6501 et seq.) to use reasonable efforts (taking into
consideration available technology) to provide a parent with
direct notice and to obtain verifiable parental consent.
(b) Revocation of Consent.--
(1) In general.--With respect to a parent of a teen who has
provided verifiable parental consent under subsection (a)(1), a
covered entity shall provide such parent with the ability to
revoke such consent.
(2) Effect of verifiable parental consent.--If a covered
entity receives a revocation of verifiable parental consent
under paragraph (1), the covered entity shall suspend, delete,
or otherwise disable the user account or profile of the teen on
the artificial intelligence chatbot that is subject to such
revocation.
(c) Rule of Construction.--Nothing in this section shall be
construed to require a covered entity to require a teen or the parent
of such teen to provide government-issued identification for--
(1) relationship verification; or
(2) the provision of verifiable parental consent under
subsection (a)(1).
SEC. 5. PARENTAL CONTROLS AND SETTINGS FOR FAMILY ACCOUNTS.
(a) Parental Controls and Settings.--Any family account provided by
a covered entity to meet the requirements of section 3 or 4 shall
permit the parent of a child or teen user, as applicable, to--
(1) determine the privacy and account settings for the user
account or profile of such child or teen, including the ability
to--
(A) limit the amount of time the child or teen is
able to spend using the artificial intelligence chatbot
of the covered entity;
(B) disable rewards or incentives, including badges
or other visual award symbols, based on frequency, time
spent, or the activity of the child or teen using the
artificial intelligence chatbot;
(C) disable notifications and push alerts;
(D) disable any financial transaction made
available while using the artificial intelligence
chatbot;
(E) disable the generation of an output from the
artificial intelligence chatbot that is not in response
to the input of a user; and
(F) enable a requirement that the covered entity
display a transparency label and set the intervals at
which the transparency label should be displayed;
(2) set the number of inputs that, or the period of time
during which, an artificial intelligence chatbot may use the
personal data of, or such inputs provided by, a child or teen
user to generate outputs before such data and such inputs must
be deleted from any memory used by the artificial intelligence
chatbot to generate outputs;
(3) access--
(A) a full record of the conversations and activity
of the child or teen with such artificial intelligence
chatbot; and
(B) features that allow the parent to monitor,
analyze, and understand, at scale, the record of such
conversations and activity; and
(4) receive customized notifications or other alerts when
the child or teen attempts to bypass, disable, or violate any
parental control or setting described in paragraph (1).
(b) Default Safeguards and Parental Control Options.--
(1) Default safeguards.--Each covered entity shall ensure
that the default setting of any parental control or setting
described in subsection (a) for a family account is the option,
or pre-set option (for purposes of paragraph (2)), that
provides the most protective level of control with respect to
the use of the artificial intelligence chatbot by a child or
teen user.
(2) Pre-set options for parents.--Each covered entity shall
provide a parent of a child or teen user with the option to
select between several pre-set tiered options for governing the
settings described in subsection (a)(2) that balance the
tradeoffs between the protectiveness to the child or teen user
and the effectiveness of the artificial intelligence chatbot.
(c) Disclosure and Transparency.--
(1) In general.--Each covered entity shall ensure that the
default setting of any parental control or setting described in
subsection (a) within a family account is accompanied by a
clear and conspicuous disclosure that defines the scope of the
setting in a manner that is understandable by an ordinary
consumer.
(2) Provision of information.--Prior to the creation of a
family account, a covered entity shall provide to the parent of
a child or teen clear and conspicuous information, which may
include a link to a web page of the covered entity, regarding--
(A) the policies and practices of the covered
entity with respect to each parental control or setting
described in subsection (a), including an easy-to-
understand explanation of the options described in such
subsection, the pre-set options described in subsection
(b)(2), and the effect of each option or pre-set
option; and
(B) how to access and manage the family account for
the child or teen user, including an easy-to-understand
explanation of how to view, change, and determine each
parental control or setting described in subsection
(a).
(d) Report.--A covered entity shall provide an easily accessible
means for a child or teen user or the parent of such child or teen user
to--
(1) report violations of the parental controls or settings
specified in subsection (a); and
(2) contact the covered entity with respect to any matter
related to child or teen use of the artificial intelligence
chatbot of the covered entity.
SEC. 6. PROHIBITION ON TARGETED ADVERTISING.
(a) In General.--A covered entity shall not use the personal data
of a user that the covered entity knows is a child or teen for purposes
of targeted advertising.
(b) Rule of Construction.--Nothing in subsection (a) shall be
construed to prohibit a covered entity that knows the age of the child
or teen from delivering advertising or marketing that--
(1) complies with the prohibition described in subsection
(a); and
(2) is age-appropriate and intended for a child or teen
audience, so long as the covered entity does not use any
personal information other than the age of the child or teen to
display such advertisement.
SEC. 7. DETERMINATION OF WHETHER A COVERED ENTITY KNOWS THAT AN
INDIVIDUAL IS A CHILD OR TEEN.
(a) Rule of Construction.--For purposes of determining whether a
covered entity knows that an individual is a child or teen, the
Commission or attorney general of a State shall rely on competent and
reliable evidence, taking into account the totality of circumstances,
including whether a reasonable and prudent person under the
circumstances would have known that the individual is a child or teen.
(b) Protections for Privacy.--Nothing in this Act, including a
determination described in subsection (a), shall be construed to
require a covered entity to--
(1) implement an age gating or age verification
functionality; or
(2) affirmatively collect any personal data with respect to
the age of any individual that the covered entity is not
already collecting in the normal course of business.
(c) Restriction on Use and Retention of Personal Data.--If a
covered entity (or a third party acting on behalf of a covered entity)
voluntarily collects personal data for the pur