United StatesChildren's Health, Advancement, Trust, Boundaries, and Oversight in Technology Act (CHATBOT Act)
In committee, dated , as of .
An AI prohibited practices rule binding private bodies.
- Obligation class
- Consent, Design code, Retention
- Audit expectation
- none
As of .
Where it has got to
The text described here is S. 4407 as introduced in the Senate. That print is S. 4407 IS, published .
Locally, this stage is ordered to be reported by the Senate Committee on Commerce, Science, and Transportation with an amendment in the nature of a substitute.
The stage above is recorded at www.congress.gov.
Introduced and referred on . The committee ordered it reported with an amendment in the nature of a substitute on ; the congress.gov record shows no later action. The House bill H.R. 7985 shares the short name CHATBOT Act but is a different bill.
What it requires
- Introduced and ordered reported by committee, not enacted, so this binds nobody yet; what follows is what it would require as introduced.
- If you run a public-facing website, online service or app whose primary function is an AI chatbot, require a user you know is under 13 to create and maintain a family account to use it.
- Before a teen you know is 13 to 17 creates an account, give a parent direct notice and obtain verifiable parental consent.
- Give each family account parental controls to limit time spent, and to disable rewards, notifications, financial transactions and unprompted outputs, and let the parent access a full record of the child's or teen's conversations and activity.
- Do not use the personal data of a user you know is a child or teen for targeted advertising.
- Terminate the existing account of a known child without a family account, or of a known teen whose parent has not given verifiable consent, and delete the personal data collected from that user.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
As introduced, a violation of the Act is treated as a violation of a rule defining an unfair or deceptive act or practice under 15 U.S.C. 57a(a)(1)(B), the chain that draws the civil penalty of 15 U.S.C. 45(m)(1)(A), a nominal $10,000 per violation adjusted for inflation to $53,088 (2025 figure) by 16 CFR 1.98.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Who enforces it
Enforcement body
Federal Trade Commission; State attorneys general as parens patriae for violations of the family account and parental consent sections.
What it makes you log
Who may demand the log
Data subject
What the log must hold
Input reference, Output reference
Logging duty
A family account must let the parent access a full record of the child's or teen's conversations and activity with the chatbot, so the covered entity must keep that record while the account is in force. The bill sets no retention period and names no other log.
- Kind
- Implicit
- As of
- Provision
- Section 5(a)(3)(A)
- Trigger
- content_generation
What this law does
Senators Cruz, Schatz, Curtis and Schiff introduced the bill on , and it was referred to the Senate Committee on Commerce, Science, and Transportation. On the committee ordered the bill to be reported with an amendment in the nature of a substitute. As introduced, a covered entity is a public-facing website, online service or software application that, as its primary function, provides an AI chatbot to users.
The bill defines a child as an individual under the age of 13. It defines a teen as an individual who has attained 13 years of age but has not attained 18 years of age. A covered entity would have to require an individual it knows is a child to create and maintain a family account to access its AI chatbot. For a teen it knows, a covered entity would have to give a parent direct notice and obtain verifiable parental consent before the teen creates an account.
A covered entity would have to terminate the existing account of a child who has not created a family account, or of a teen whose parent has not given verifiable parental consent. On terminating such an account the covered entity would have to delete the personal data collected from that user.
A family account would have to let the parent limit the time spent, disable rewards, notifications, financial transactions and unprompted outputs, and require the covered entity to display a transparency label. A family account would also have to let the parent access a full record of the conversations and activity of the child or teen with the chatbot. A covered entity could not use the personal data of a user it knows is a child or teen for targeted advertising.
The bill does not require a covered entity to implement age gating or age verification functionality. The Federal Trade Commission would enforce the bill as a violation of a rule defining an unfair or deceptive act or practice. State attorneys general could bring civil actions against a covered entity that violates section 3 or 4 of the bill. It would take effect one year after enactment.
When LexLint raises it
When your app profile says your app deploys a chatbot or serves under-18s.