Serves under-18s, in Michigan

MCL 445.72a (Sec. 12a of Act 452 of 2004, added by 2006 PA 566) · Read the law's page

• Destroy, or arrange for the destruction of, any data containing personal information about an individual once that data is removed from the database and is not being retained elsewhere for a purpose state or federal law does not prohibit; retaining the data for an investigation, audit, or internal review does not violate this duty. Destroy the data by shredding, erasing, or otherwise modifying it so it cannot be read, deciphered, or reconstructed through generally available means.
• This binds a person (a private business or other legal entity) or an agency (a Michigan state government department, board, commission, office, authority, or unit, including a public university, but not a court) that maintains a database including personal information about multiple Michigan residents.
• You are considered compliant here if you are already subject to, and in compliance with, a federal law governing the disposal of records containing personal identifying information.
• A knowing violation is a misdemeanor punishable by a fine of up to $250 for each violation; this section creates no private right of action, though it preserves whatever other civil remedy state or federal law might otherwise provide.

2025 S.B. 360, proposed MCL 445.71a and 445.85c (secs. 11a and 20c), as passed by the Senate · Read the law's page

• As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.
• Reasonableness is judged by your size, the amount of personal information you own, possess, collect, or access, the type of activities for which you handle it, and the cost of the procedures relative to your resources. Conforming to the current NIST Cybersecurity Framework 2.0, or already being regulated by Michigan or the federal government and reasonably conforming to HIPAA, Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, is deemed compliance.

Mich. S.B. 760 (2025 Session), as passed by the Senate · Read the law's page

• Do not make available to a user of an advanced chatbot a feature that simulates companionship or an interpersonal relationship, or an output that endorses, promotes, or facilitates suicide or self-harm, encourages secrecy about the interaction, self-isolation, or not seeking help, or is, describes, or facilitates sexually explicit conduct or child sexual abuse material, unless you have actual knowledge that the user is not a minor.
• Do not treat a user's own statement that the user is not a minor as enough by itself to establish actual knowledge of age.
• Do not train the underlying model of an advanced chatbot with a minor's inputs unless the minor's parent or guardian gives written consent for that specific purpose.
• Delete the personal data you collect from a user immediately after using it to determine whether the user is a minor.

Senate Bill 758, 2025-2026 Regular Session · Read the law's page

• The enacting sections of this bill provide that it does not take effect unless Senate Bill No. 759 of the 103rd Legislature is enacted into law.
• If your online service is reasonably likely to be accessed by a covered minor, give a parent tools to manage the minor's privacy and account settings, screen time, and purchases.
• Collect only the personal data a covered minor needs for the service.
• Do not use profiling, dark patterns, or personalized-feed recommendations directed at a covered minor absent the minor's own request.

Senate Bill 759, 2025-2026 Regular Session (amending MCL 445.903) · Read the law's page

• The enacting sections of Senate Bill 758, the Michigan Kids Code Act, provide that it does not take effect unless this bill is enacted into law.
• This bill sets no design duty of its own: it would make a violation of the Michigan Kids Code Act (Senate Bill 758) an unfair, unconscionable, or deceptive trade practice, so the Consumer Protection Act's existing private right of action and the Attorney General's enforcement powers would apply to a Kids Code violation.

Senate Bill 760, 2025-2026 Regular Session · Read the law's page

• Applies to operators of an advanced chatbot, a generative AI system with a natural language interface that provides ongoing, adaptive responses, other than narrowly tailored educational tools and basic customer-service systems.
• Do not make an advanced chatbot available to a minor if it could foreseeably undermine the minor's safety, wellbeing, or development.
• Restrict data collection, companionship-simulating design features, and training the chatbot on a minor's inputs, absent written consent from the minor's parent or guardian.