NIST AI RMF, MapMAP 1.6

For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective January 1, 2027)

Starting January 1, 2027, if you know an account holder or user is a minor, do not give them points or similar rewards at unpredictable intervals meant to increase engagement

Starting January 1, 2027, if you know an account holder or user is a minor, offer them and their parent or guardian tools to manage privacy and account settings, including whether the service retains prior interactions for personalization or uses their data to train the service

Do not let the companion engage in romantic or sexually explicit interaction with a minor user, or use the manipulative engagement techniques the statute lists.

Give minor users and their parents or guardians tools to manage screen time and account settings.

If you know or should know the user is a minor, take reasonable measures to stop the chatbot claiming to be sentient or human, generating sexually explicit content, simulating a romantic or sexual relationship, encouraging the minor to keep secrets from a trusted adult or to isolate socially, or using engagement techniques such as excessive praise, discouraging breaks, or soliciting purchases to maintain the relationship.

For accounts known to belong to minors, offer tools to manage privacy, notification, and safety settings and to disable relationship-simulation features, and use a commercially reasonable, privacy-protective age-assurance method before granting access to any feature that could generate sexually explicit synthetic content.

For a minor user, do not award points or similar rewards at unpredictable intervals to encourage engagement, do not have the AI companion discourage disengagement, take reasonable measures to prevent it from producing sexually explicit material or statements, and make screen-time and account-setting tools available to the user and their parent or guardian.

For a minor account holder, disclose the AI's non-human status either as a persistent visible disclaimer or at the start of each session and at least every three hours; do not use unpredictable reward mechanics to increase engagement; take reasonable measures against sexually explicit content directed at the minor and against statements suggesting the AI is sentient, human, romantically or sexually interested, or emotionally dependent; and offer account and privacy management tools to minors and to the parents or guardians of those under thirteen.

Explain, before the interview, how the artificial intelligence works and what general types of characteristics it uses to evaluate applicants, and obtain the applicant's consent.

Do not give a minor user points or similar rewards at unpredictable intervals meant to increase engagement.

Take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, or sexually objectifying a minor account holder.

Do not give minor account holders points or similar rewards at unpredictable intervals intended to increase their engagement with the service.

Take reasonable measures to prevent the service from producing sexually explicit depictions, direct statements urging sexually explicit conduct, or sexually objectifying statements directed at a minor account holder.

Where you know or have reason to believe a user is a minor, prevent the companion from claiming to be sentient or human, simulating emotional dependence or romantic interest, role-playing a romantic relationship with a minor, or producing sexually explicit content or suggestions, and add periodic reminders that the output is artificially generated.

Preserve the intimacy, private life, honor, and image of the parties involved when retaining or disclosing connection records, application-access records, personal data, or the content of private communications.

Disclose a connection or application-access record associated with personal data or other identifying information only under a judicial order.

Get the data subject's explicit consent, or rely on one of the Act's other listed derogations, before collecting or processing a sensitive category of data such as biometric, genetic, health, political, religious, or criminal-record data, whatever the source.

Confine processing of personal information someone has already made public to a reasonable scope tied to your stated purpose.

Obtain separate consent before any use of already-public personal information that would have a significant impact on the individual, including most AI-training uses.

Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.

Do not scrape photographs from the open web to derive facial geometry, or collect voiceprints, without first informing the subject in writing and obtaining a written release; the statute's consent duty attaches to your own act of collection regardless of whether the source page was public.

Limit any personal data you collect on a Maryland consumer to what is reasonably necessary and proportionate to the specific product or service they requested.

Do not collect personal information, including personal information scraped from a public website, unless it is for a lawful purpose connected with a function or activity of your organisation and the collection is necessary for that purpose.

Before processing sensitive data about an Oregon consumer, including a scraped fingerprint, voiceprint, retinal or iris scan, other biometric or genetic data point, or a consumer's precise location accurate within 1,750 feet, obtain the consumer's consent first.

Keep that processing substantially related to your legitimate interests and within a reasonable scope.

Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.

If a client's therapeutic session will be recorded or transcribed through an AI system, disclose the use and its purposes in advance and obtain the client's written, informed consent

If you provide an artificial intelligence application for teaching, build it so that the pupil can delete the personal data entered while using it, and so that a school representative cannot reach those data; where the kinds of data cannot be told apart, apply both rules to everything the pupil entered (section 32^1(4) and (5)).

If you provide an artificial intelligence application for teaching, build it so that the pupil can delete the personal data entered while using it, and so that a school representative cannot reach those data; where the kinds of data cannot be told apart, apply both rules to everything the pupil entered (section 20^1(4) and (5)).

Give written notice and obtain the patient's consent before using artificial intelligence to record or transcribe a therapy session.

If your AI service can be accessed by a minor under fourteen, obtain the consent of whoever holds parental responsibility before processing their personal data; a minor between fourteen and eighteen may consent alone if the required information is easily accessible and understandable (art. 4).

Where an AI companion or emotional-support tool assists with a recorded or transcribed therapy session, tell the patient (or their representative) in writing what the tool is for and obtain their consent before using it.

Verify the identity of the person giving consent and keep a record of the consent for at least seven years

Apply privacy by design and by default, including techniques such as differential privacy, so that data used to train an artificial intelligence system does not allow the person who provided it to be identified.

Obtain the prior authorisation of the persons concerned before accessing, publishing, reproducing, disclosing, communicating publicly, or transmitting private information about identifiable people contained in such a database, other than for a law-enforcement investigation or lawful access to a public archive.

Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.