Chatbot Laws · verified Oct. 21, 2026
As approved by Senate Commerce, would require chatbot deployers who know a user is under 18 to disclose that the user is talking to AI, limit the chatbot's use of the minor's personal data to the current session unless a parent opts in, bar engagement features like rewards and push alerts, and ban ads and training on minors' data. Parents could sue.
Who it would cover
Deployers (anyone who owns, operates or makes an AI chatbot available in interstate or foreign commerce) and developers, as to users they know (actual knowledge or knowledge fairly implied) are minors under 18. No age verification is required.
What it would require
| AI disclosure | A deployer that knows a user is a minor must disclose, in plain age-suited language, that the user is not talking to a human and that content is AI-generated.When: At the start of each conversation and when the user resumes a conversation after 24 hours of inactivity§ 4(a) |
|---|---|
| Minors | For known minors, the chatbot may use personal data to shape outputs only if collected in the current session, which ends 12 hours after the minor's last input or 3 days after it began. A parent may opt in, through a separate non-default control, to longer or indefinite periods.§ 4(b) (as amended by Cruz amendment 1) |
| Design limits | For known minors, no usage-based rewards or badges, no push notifications other than the AI disclosure, no unprompted outputs, and no typing bubbles or online indicators that mimic a human.§ 4(c) |
| Data limits | For known minors: no advertising or paid product promotion, no use or transfer of their data to train AI models except to test for or address harm, and input data used only to generate outputs or address harm.§ 5(a), (c)-(d) |
| Other duties | Whistleblower protections; adds AI chatbots to an NIH research program on technology and children's health; CDC and HHS surveys to ask about chatbot use. State laws at least as protective are not preempted.§§ 6-8; § 9(d) |
Enforcement
| Enforced by | Federal Trade Commission, State attorneys general (parens patriae) and Private right of action (parents or guardians)§ 9(a)-(c) |
|---|---|
| Private lawsuits | Yes |
| Penalties | Parents or guardians may sue deployers or developers for violations of §§ 4-5 for actual and punitive damages, attorney's fees, and injunctive or declaratory relief. FTC treats violations of §§ 4-6 as unfair or deceptive practices rule violations; state AGs may seek injunctions, damages or restitution. |
Sources
- All actions, Congress.gov Supports: Latest action and dates.
- Cosponsors, Congress.gov Supports: Sponsor and cosponsor count.
- Bill text, Congress.gov Supports: Introduced text.
- Markey substitute (as modified again), Senate Commerce Committee Supports: Committee-approved text, §§ 2-10.
- Cruz amendment 1 (as modified), Senate Commerce Committee Supports: Session-based data limit and parent opt-in, § 4(b).
- Budd amendment 1, Senate Commerce Committee Supports: Research section without funding authorization, § 7.
- Lummis amendment 1, Senate Commerce Committee Supports: Profiling definition and ban struck.
- Lummis amendment 2, Senate Commerce Committee Supports: Severability subsection struck.
- Senate Commerce Committee release, Aug 5, 2026 Supports: Voice vote and amendments adopted.