Chatbot Laws · verified Oct. 21, 2026
Would limit how AI chatbot providers use chat logs and personal data, including bans on training with minors' chats and selling chat logs, require an AI disclosure before the first response and every hour, and require monthly risk assessments with quarterly public reports. Customer service chatbots would have to be disclosed with a right to reach a human, and the FTC, state attorneys general and injured people could sue.
Who it would cover
Any person who creates, distributes or makes publicly available an AI chatbot (provider), with no size threshold; the customer-service duties apply to any business using a chatbot for customer service. Services limited to contextual replies within a narrow purpose are excluded; services that simulate sustained emotional relationships or persistent personas are included.
What it would require
| AI disclosure | Users must get a clear and conspicuous notice that they are talking to AI, not a human, in their language, in type at least as large as the largest other text, and accessible to people with disabilities.When: Before the first output, every hour after, and whenever a user asks if it is a real person§ 2(b)(2) |
|---|---|
| Minors | Processing a known or presumed minor's chat logs or personal data needs parental consent (except age itself), training on minors' chat logs is barred, and for users known or likely to be under 18 providers must disable features that create an unreasonable risk of covered harm, emotional dependence or compulsive use, under FTC rules.§ 2(a)(1)(C); § 2(c)(3) |
| Reporting | Providers must assess the chatbot at least monthly, using FTC metrics, for risk of covered harm (death, suicide attempt or psychiatric emergency), emotional dependence and compulsive use, and publish the results on their websites at least quarterly.§ 2(c)(1)-(2); § 5(9) |
| Therapy and licensed titles | Providers may not imply that outputs come from, are endorsed by or equal those of a licensed health care professional or therapist, lawyer, accountant, or certified financial fiduciary or planner.§ 2(b)(1)(B) |
| Data limits | No processing of personal data beyond inputs without an express request and affirmative consent; no use of chat logs for advertising decisions, no sale of chat logs, no profiling beyond a user's request; affirmative consent before training on adults' chat logs; retention capped at 5 years; access and deletion rights; a written security program within 12 months; no claims that chats are confidential; and no government access to chat logs without a warrant.§ 2(a); § 2(b)(1)(A) |
| Other duties | Any business using an AI chatbot for customer service must disclose it at the start of each communication and, on request (by voice where possible), transfer the consumer immediately to a human operator located in the United States.§ 2(d) |
Enforcement
| Enforced by | Federal Trade Commission, State attorneys general (parens patriae) and Private lawsuits§ 4 |
|---|---|
| Private lawsuits | Yes |
| Penalties | FTC Act penalties (violations treated as violations of an FTC unfair or deceptive practices rule). Private suits: actual damages or up to $10,000 per violation of § 2(a), (c)(1) or (c)(2), and up to $10,000 in total for § 2(b) violations; for § 2(c)(3) violations, actual damages plus at least $50,000, at least $100,000 if emotional dependence or compulsive use results, or at least $250,000 if a covered harm results; up to five times for willful or knowing violations; fees and costs. A user injured by chatbot use may also recover actual damages even if the provider used all reasonable care. |
Sources
- H.R. 9619 as introduced (text), GPO govinfo Supports: Titles, sponsor, §§ 1-7.
- Bill status data (Library of Congress feed, GPO govinfo) Supports: Introduction and referral Jul 9, 2026; sponsor and original cosponsor; latest action.
- Reps. Foushee, Casar introduce legislation (press release, Jul 9, 2026) Supports: Sponsors' description of the bill.