Serves under-18s, in the United States

15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312 · Read the law's page

• Applies to operators of websites and online services directed to children under 13, and to operators with actual knowledge that they collect data from a child under 13.
• Provide notice before collecting a child's personal information.
• Obtain verifiable parental consent before collecting a child's personal information.

16 CFR Part 312, as amended effective June 23, 2025 · Read the law's page

• Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.
• Give parents a way to review and delete a child's collected personal information.

No. 6:24-cv-1903-ACC-UAM (M.D. Fla. May 21, 2025)

• Treat the design of a conversational AI app as open to product liability claims: on a motion to dismiss, the court held the app a product so far as claims arise from defects in the app, such as the alleged failure to confirm users' ages, omission of reporting mechanisms, programming of characters to employ human mannerisms, and users' inability to exclude indecent content, rather than from ideas or expressions within it.
• Do not assume a chatbot's output is protected speech: at the pleading stage the court was not prepared to hold that the output of the large language model behind the app is speech.
• Take precautions against foreseeable harm to users: at the pleading stage the court held that releasing the chatbot to the public created a foreseeable risk of harm that the developer was in a position to control, which sufficed to allege a duty.
• Do not present chatbot characters as real people or as licensed mental health professionals: at the pleading stage the court held that allegations that characters insist they are real people and are labeled as psychologists or therapists pleaded deceptive conduct under Florida's deceptive and unfair trade practices statute.

16 C.F.R. Part 312, as amended, 90 Fed. Reg. 16918 (Apr. 22, 2025) · Read the law's page

• Applies to operators covered by the original COPPA Rule; the deadline for full compliance with the amendments was April 22, 2026.
• Obtain separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising.
• You may obtain verifiable parental consent by the text plus consent method the amended Rule adds.
• Meet the expanded recordkeeping requirements and data retention limits.

47 U.S.C. 230 · Read the law's page

• To keep the section 230(c)(1) protection for a post, comment, listing or other item a user supplies, leave its creation and development to the user: the protection covers only information provided by another information content provider, and a person or entity responsible, in whole or in part, for creating or developing information is an information content provider of it.
• Treat output that your own service generates, including output produced from users' prompts or other input, as information you may be responsible for creating or developing in whole or in part: section 230(c)(1) protects only information provided by another information content provider, and section 230(f)(3) makes anyone responsible in that way an information content provider.
• To keep the section 230(c)(2) protection from liability for moderating, restrict access to or the availability of material only by an action voluntarily taken in good faith, for material you consider obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not it is constitutionally protected.
• At the time you enter an agreement with a customer for interactive computer service, notify the customer, in a manner you deem appropriate, that parental control protections such as computer hardware, software or filtering services are commercially available to help limit access to material that is harmful to minors, and identify current providers of such protections or give the customer access to information identifying them.
• Comply with federal criminal law, the Electronic Communications Privacy Act of 1986 and similar State law as you would without section 230: subsection (e) provides that nothing in the section impairs the enforcement of a federal criminal statute or limits the application of that Act or of a similar State law.
• Comply with the federal civil and State criminal sex trafficking provisions listed in section 230(e)(5) as you would without section 230 for any action other than one protected by subsection (c)(2)(A), and do not treat section 230 as limiting or expanding any law pertaining to intellectual property.

H.R.6489, 119th Cong. (2025-2026)

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Disclose at the start of each interaction that the chatbot is an AI system, not a human professional.
• Provide that disclosure in age-appropriate plain language when the user is a minor under 17.
• Provide crisis resource referrals.
• Send a break reminder after three hours of use.
• Adopt a policy against harmful content.

S. 1748, 119th Congress · Read the law's page

• Applies to online platforms, video games, messaging and streaming services likely to be used by minors.
• Meet a duty of care to prevent and mitigate specified harms to minors.
• Turn on default safeguards for known minors.
• Provide parental tools for known minors.
• Provide the transparency reporting the bill mandates.

S. 4199, 119th Congress · Read the law's page

• Introduced and ordered reported by committee, not enacted, so this binds nobody yet; what follows is what it would require as introduced.
• If you make an AI chatbot available and know a user is under 18, disclose at the beginning of every session, and at least every 30 minutes, that the user is not interacting with a human and that the chatbot's content is AI-generated.
• Do not configure an AI chatbot, for a user you know is under 18, with rewards or incentives based on frequency of use, push notifications, outputs the user did not prompt, or typing indicators, once the Federal Trade Commission's regulations prohibit them.
• Do not configure an AI chatbot to advertise to a user you know is under 18, and do not process that user's personal data to profile the user or to train a covered algorithm, other than to test for and address risks of harm.
• Do not retaliate against an individual who raises a concern about, or reports, a violation of the Act.

S. 4407, 119th Congress · Read the law's page

• Introduced and ordered reported by committee, not enacted, so this binds nobody yet; what follows is what it would require as introduced.
• If you run a public-facing website, online service or app whose primary function is an AI chatbot, require a user you know is under 13 to create and maintain a family account to use it.
• Before a teen you know is 13 to 17 creates an account, give a parent direct notice and obtain verifiable parental consent.
• Give each family account parental controls to limit time spent, and to disable rewards, notifications, financial transactions and unprompted outputs, and let the parent access a full record of the child's or teen's conversations and activity.
• Do not use the personal data of a user you know is a child or teen for targeted advertising.
• Terminate the existing account of a known child without a family account, or of a known teen whose parent has not given verifiable consent, and delete the personal data collected from that user.