NIST AI RMF, MapMAP 1.6

For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions

Do not give a minor account holder or user points or similar rewards at unpredictable intervals meant to increase engagement

Offer the minor account holder or user, and their parent or guardian, tools to manage privacy and account settings, including whether the service retains prior interactions for personalization or uses their data to train the service

Do not let the companion engage in romantic or sexually explicit interaction with a minor user, or use the manipulative engagement techniques the statute lists.

Give minor users and their parents or guardians tools to manage screen time and account settings.

If you know or should know the user is a minor, take reasonable measures to stop the chatbot claiming to be sentient or human, generating sexually explicit content, simulating a romantic or sexual relationship, encouraging the minor to keep secrets from a trusted adult or to isolate socially, or using engagement techniques such as excessive praise, discouraging breaks, or soliciting purchases to maintain the relationship.

For accounts known to belong to minors, offer tools to manage privacy, notification, and safety settings and to disable relationship-simulation features, and use a commercially reasonable, privacy-protective age-assurance method before granting access to any feature that could generate sexually explicit synthetic content.

For a minor user, do not award points or similar rewards at unpredictable intervals to encourage engagement, do not have the AI companion discourage disengagement, take reasonable measures to prevent it from producing sexually explicit material or statements, and make screen-time and account-setting tools available to the user and their parent or guardian.

For a minor account holder, disclose the AI's non-human status either as a persistent visible disclaimer or at the start of each session and at least every three hours; do not use unpredictable reward mechanics to increase engagement; take reasonable measures against sexually explicit content directed at the minor and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent; and offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.

Explain, before the interview, how the artificial intelligence works and what general types of characteristics it uses to evaluate applicants, and obtain the applicant's consent.

Do not give a minor user points or similar rewards at unpredictable intervals meant to increase engagement.

Take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, or sexually objectifying a minor account holder.

Do not give minor account holders points or similar rewards at unpredictable intervals intended to increase their engagement with the service.

Take reasonable measures to prevent the service from producing sexually explicit depictions, direct statements urging sexually explicit conduct, or sexually objectifying statements directed at a minor account holder.

Where you know or have reason to believe a user is a minor, prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content or suggestions, and add periodic reminders that the output is artificially generated.

Preserve the intimacy, private life, honor, and image of the parties involved when retaining or disclosing connection records, application-access records, personal data, or the content of private communications.

Disclose a connection or application-access record associated with personal data or other identifying information only under a judicial order.

Get the data subject's explicit consent, or rely on one of the Act's other listed derogations, before collecting or processing a sensitive category of data such as biometric, genetic, health, political, religious, or criminal-record data, whatever the source.

Confine processing of personal information someone has already made public to a reasonable scope tied to your stated purpose.

Obtain separate consent before any use of already-public personal information that would have a significant impact on the individual, including most AI-training uses.

Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.

Do not scrape photographs from the open web to derive facial geometry, or collect voiceprints, without first informing the subject in writing and obtaining a written release; the statute's consent duty attaches to your own act of collection regardless of whether the source page was public.

Limit any personal data you collect on a Maryland consumer to what is reasonably necessary and proportionate to the specific product or service they requested.

Do not collect personal information, including personal information scraped from a public website, unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.

Before processing sensitive data about an Oregon consumer, including a scraped fingerprint, voiceprint, retinal or iris scan, other biometric or genetic data point, or a consumer's precise location accurate within 1,750 feet, obtain the consumer's consent first.

Limit the personal data you collect and use to what is adequate and necessary for that stated purpose.

Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.

Give written notice and obtain the patient's consent before using artificial intelligence to record or transcribe a therapy session.

If your AI service can be accessed by a minor under fourteen, obtain the consent of whoever holds parental responsibility before processing their personal data; a minor between fourteen and eighteen may consent alone if the required information is easily accessible and understandable (art. 4).

If you are a Maine-licensed therapy professional using AI for supplementary support such as session notes, give the client written disclosure and get consent first, and never let AI make an independent therapeutic decision, interact directly with the client in therapeutic communication, or generate a treatment recommendation without your review and approval.

Where an AI companion or emotional-support tool assists with a recorded or transcribed therapy session, tell the patient (or their representative) in writing what the tool is for and obtain their consent before using it.

Verify the identity of the person giving consent and keep a record of the consent for at least seven years

Obtain the prior authorisation of the persons concerned before accessing, publishing, reproducing, disclosing, communicating publicly, or transmitting private information about identifiable people contained in such a database, other than for a law-enforcement investigation or lawful access to a public archive.