,,ii #aaith ,,congress #b;d ,session ,s4 #daii ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #be1 #bjbf,mr4 ,markey introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require entities that make artificial intelligence chatbots available to minors to implement certain safe design features1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,youth ,,ai ,privacy ,act4 #b4 ,findings ,congress finds the following3 7#a7 ,millions of teenagers are using artificial intelligence 7referred to in this section as ,,ai7 chatbots for personal1 sensitive conversations1 disclosing intimate details about their lives1 relying on ,,ai chatbots for advice1 and developing deep emotional bonds with ,,ai chatbots4 7#b7 ,in #bjbe1 approximately #b_/c of teenagers reported using ,,ai chatbots1 and roughly #a_/d reported using them daily4 #a_/c of teens have chosen to speak with ,,ai chatbot companions over a real human for a serious conversation4 ,in a couple tragic cases1 a teenager died by suicide after encouragement or advice from an ,,ai chatbot4 7#c7 ,although compulsive use of ,,ai chatbots may pose risks for all users1 users who are minors1 whose cognitive1 emotional1 and social capabilities are still developing1 are especially likely to misunderstand that an ,,ai chatbot is not a real human and disclose sensitive personal information to the ,,ai chatbot or turn to the ,,ai chatbot for social companionship4 ,minors are also more susceptible to addictive design features1 anthropomorphized systems1 and potentially harmful outputs generated by ,,ai systems4 7#d7 ,,ai chatbot companies are employing manipulative engagement features to keep users engaged on their platforms1 including high-frequency push notifications1 unprompted ,,ai chatbot responses1 typing bubble indicators1 and more4 ,these features create serious risks of emotional dependency and compulsive use among minors4 7#e7 ,,ai chatbots mimic human-like conversations by employing profiling tactics to personalize outputs for users4 ,,ai chatbots are also often designed to resemble direct messaging user interfaces4 ,these personalization strategies and anthropomorphic design features can easily confuse users1 especially minors1 who may believe they are interacting with a real person rather than ,,ai4 7#f7 ,advertisements delivered through ,,ai chatbots may be woven directly into responses or may subtly steer users toward certain products based on how the model was trained4 ,this advertising would be far more covert and harder to recognize than traditional digital advertising1 especially for minors4 ,as highlighted by the ,commission1 many young users lack the skills or cognitive defenses needed to identify such covert or blurred advertising4 7#g7 ,extended1 multiturn conversations with ,,ai chatbots degrade safeguards against harmful conversational patterns1 increasing the likelihood of minors receiving harmful outputs generated by ,,ai systems4 7#h7 ,,ai chatbots introduce new privacy risks1 as they often retain user inputs and personal data to personalize responses and to train the underlying large language models4 ,this practice creates the potential for serious privacy violations1 particularly when companies retain and process highly sensitive information from minors4 7#i7 ,congress has a responsibility to address the novel risks posed by ,,ai chatbots and protect minors from potential harm related to anthropomorphism1 prolonged engagement1 deceptive advertising1 and invasive privacy practices4 #c4 ,definitions ,in this ,act3 7#a7 ,,ai chatbot ,the term ,,ai chatbot means a natural language interface that uses a covered algorithm to provide adaptive responses to user inputs via text1 audio1 image1 video1 or any other mode of communication1 simulating interpersonal interaction with a user4 7#b7 ,collect ,the term collect means1 with respect to personal data1 to buy1 rent1 gather1 obtain1 receive1 access1 or otherwise acquire the personal data by any means4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,covered algorithm ,the term covered algorithm means a computational process derived from machine learning1 natural language processing1 neural networks1 or other technology of similar or greater complexity4 7#e7 ,deployer 7,a7 ,in general ,the term deployer means any person that owns1 operates1 or otherwise makes available to users an ,,ai chatbot in or affecting interstate commerce4 7,b7 ,rule of construction ,the terms deployer and developer shall not be interpreted to be mutually exclusive4 7#f7 ,derived data ,the term derived data means data that is created by the derivation of information1 other data1 assumptions1 correlations1 inferences1 predictions1 or conclusions from facts1 evidence1 or another source of information4 7#g7 ,developer 7,a7 ,in general ,the term developer means any person that designs1 codes1 produces1 or substantially modifies a covered algorithm for use in an ,,ai chatbot4 7,b7 ,rule of construction ,the terms developer and deployer shall not be interpreted to be mutually exclusive4 7#h7 ,input data ,the term input data means1 with respect to an ,,ai chatbot1 all information1 including text1 photos1 audio1 video1 or files1 provided to the ,,ai chatbot by a user of such ,,ai chatbot4 7#i7 ,knowledge ,the term knowledge means actual knowledge or knowledge fairly implied on the basis of objective circumstances4 7#aj7 ,minor ,the term minor means an individual who is under the age of #ah4 7#aa7 ,output ,the term output means1 with respect to an ,,ai chatbot1 any information1 including any text1 photo1 audio recording1 video1 or file1 provided by such ,,ai chatbot to a user4 7#ab7 ,personal data ,the term personal data-- 7,a7 means information1 including input data1 derived data1 inferences1 or unique identifiers1 that identifies or is linked1 or reasonably linkable1 alone or in combination with other information1 to an individual or a device that identifies or is linked1 or reasonably linkable1 to #a or more individuals2 and 7,b7 does not include publicly available information4 7#ac7 ,profiling ,the term profiling means processing data for the purpose of detecting and classifying or designating personality and behavioral characteristics of a user of an ,,ai chatbot4 7#ad7 ,process ,the term process means1 with respect to personal data1 any operation or set of operations performed on the personal data1 including analyzing1 organizing1 structuring1 using1 modifying1 or otherwise handling such data4 7#ae7 ,publicly available information 7,a7 ,in general ,the term publicly available information-- 7i7 means any information that a deployer has a reasonable basis to believe has been made available to the general public by-- 7,i7 ,federal1 ,state1 or local government records2 7,,ii7 widely distributed media2 7,,iii7 a website or online service made available to any member of the public1 for free or for a fee1 including a website or online service that any member of the public can log into2 or 7,,iv7 a disclosure to the general public that is required under ,federal1 ,state1 or local law2 and 7ii7 does not include-- 7,i7 any obscene visual depiction 7as such term is used in section #adfj of title #ah1 ,united ,states ,code72 7,,ii7 biometric information2 7,,iii7 genetic information1 unless made publicly available by the individual to whom the information pertains by a means described in subclause 7,,ii7 or 7,,iii7 of clause 7i72 7,,iv7 personal data that is created through the combination of personal data with publicly available information2 7,v7 intimate images that are authentic or computer-generated1 known to be nonconsensual2 or 7,,vi7 personal data made available by a data broker4 7,b7 ,clarification ,for purposes of this paragraph1 information from a website or online service is not available to any member of the public if the individual to whom the information pertains has restricted the information to a specific audience or maintained a default setting that restricts the information to a specific audience4 7#af7 ,transfer ,the term transfer means1 with respect to personal data1 to disclose1 release1 share disseminate1 make available1 sell1 rent1 or license the personal data 7orally1 in writing1 electronically1 or by any other means74 7#ag7 ,widely distributed media ,the term widely distributed media-- 7,a7 means information that is available to the general public1 including information from a telephone book or online directory1 a television1 internet1 or radio program1 the news media1 or an internet site1 that is available to the general public on an unrestricted basis2 and 7,b7 does not include an obscene visual depiction 7as such term is used in section #adfj of title #ah1 ,united ,states ,code74 #d4 ,safe design features 7a7 ,required disclosures 7#a7 ,in general ,a deployer with knowledge that a user of an ,,ai chatbot is a minor shall disclose that-- 7,a7 the user is not interacting with a human2 and 7,b7 any content provided by the ,,ai chatbot is generated by artificial intelligence4 7#b7 ,content and duration of disclosure ,a disclosure made by a deployer pursuant to paragraph 7#a7 shall-- 7,a7 be stated in clear1 plain1 and easy-to-understand language suited to the age of minors likely to access the ,,ai chatbot2 7,b7 occur at the beginning of every session 7as defined by the ,commission72 7,c7 reoccur not less than once every #cj minutes during a session 7as so defined72 and 7,d7 be appropriate for the medium of the content1 as determined by the ,commission4 7b7 ,limitation on the processing of personal data ,to provide outputs 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations to prohibit a deployer with knowledge that a user of an ,,ai chatbot is a minor from processing any personal data of the user to generate1 personalize1 or otherwise affect an output provided to such user1 unless the personal data was collected during the current session 7as defined by the ,commission7 more recently than the maximum permitted period of use established by the ,commission under paragraph 7#b74 7#b7 ,maximum permitted period of use ,in promulgating the regulations described in paragraph 7#a71 the ,commission shall determine a maximum permitted period of use during which a deployer with knowledge that a user of an ,,ai chatbot is a minor may collect personal data from such a user and process such data to generate1 personalize1 or otherwise affect an output 7as defined by the ,commission7 provided to such user during a current session 7as defined by the ,commission74 7c7 ,exclusion of features that encourage compulsive use ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate regulations to prohibit a deployer or developer with knowledge that a user of an ,,ai chatbot is a minor from configuring such ,,ai chatbot to include1 with respect to such user1 the following features3 7#a7 ,any reward or incentive based on the frequency of use1 time spent1 or activity using the ,,ai chatbot4 7#b7 ,notifications and push alerts1 other than a disclosure required by subsection 7a74 7#c7 ,any badge or other visual award symbol based on the frequency of use1 time spent1 or activity using the ,,ai chatbot4 7#d7 ,generation of an output absent a user-initiated input or any form of solicitation of engagement from a user4 7#e7 ,usage traces that mimic social interactions with a human1 such as typing bubbles or indicators showing that the ,,ai chatbot is available or online4 #e4 ,data privacy protections 7a7 ,prohibition on advertising and promotion ,a deployer or developer with knowledge that a user of an ,,ai chatbot is a minor shall not configure or modify an ,,ai chatbot to-- 7#a7 advertise to such user2 or 7#b7 generate an output that promotes1 markets1 recommends1 or endorses a product or service to such user if the weight or credibility of such promotion1 marketing1 recommendation1 or endorsement is materially affected by a financial connection between the deployer or developer and the seller of such product or service4 7b7 ,prohibition on processing of personal data for profiling ,a deployer with knowledge that a user of an ,,ai chatbot is a minor shall not process any personal data of the user to engage in any profiling of such user4 7c7 ,prohibition on the processing or transferring of personal data ,to train a covered algorithm 7#a7 ,in general ,except as provided in paragraph 7#b71 a deployer with knowledge that a user of an ,,ai chatbot is a minor shall not-- 7,a7 process the personal data of such minor for the purpose of training a covered algorithm2 or 7,b7 transfer the personal data of such minor to a third party for the purpose of training a covered algorithm4 7#b7 ,exceptions ,a deployer with knowledge that a user of an ,,ai chatbot is a minor may process personal data of such minor for the express purpose of-- 7,a7 testing and identifying risks of harm to users2 or 7,b7 addressing identified risks of harm to users4 7d7 ,prohibition on processing of input data ,beginning on the date that is #cj days after the ,commission promulgates regulations under section #d7;b77#a71 a deployer with knowledge that a user of an ,,ai chatbot is a minor shall not process any input data provided to such ,,ai chatbot by such user for any purpose1 other than for the express purpose of-- 7#a7 generating1 personalizing1 or affecting an output provided to such user when the input data was collected during the current session 7as defined by the ,commission7 more recently than the maximum permitted period of use established by the ,commission under section #d7;b77#b72 7#b7 testing and identifying risks of harm to users2 or 7#c7 addressing identified risks of harm to users4 #f4 ,whistleblower protections ,a deployer or developer may not1 directly or indirectly1 discharge1 demote1 suspend1 threaten1 harass1 or otherwise discriminate or retaliate against an individual for raising a concern regarding a violation of this ,act1 reporting or attempting to report a violation of this ,act1 or cooperating in any investigation or enforcement proceeding pursuant to this ,act4 #g4 ,research on the health and developmental effects of ,,ai chatbots on minors ,section #adcb of the ,restoring ,hope for ,mental ,health and ,well-,being ,act of #bjbb 7#db ,u4,s4,c4 #bhe;g-#aa7 is amended-- 7#a7 in subsection 7a71 by inserting1 ,,ai chatbots1 after augmented reality12 and 7#b7 by adding at the end the following3 7e7 ,authorization of appropriations ,to carry out this section1 there are authorized to be appropriated #ej1jjj1jjj for each of fiscal years #bjbg through #bjcj4 4 #h4 ,survey inclusion requirement ,the ,secretary of ,health and ,human ,services1 acting through the ,director of the ,centers for ,disease ,control and ,prevention and in coordination with the ,director of the ,national ,institutes of ,health1 shall incorporate questions related to the use1 by youth and by adults1 of ,,ai chatbots into national health and behavioral surveys conducted by the ,department of ,health and ,human ,services1 including the ,household ,pulse ,survey and the ,youth ,risk ,behavior ,surveillance ,system of the ,centers for ,disease ,control and ,prevention1 including questions designed to capture the following3 7#a7 ,frequency and duration of ,,ai chatbot uses4 7#b7 ,types of ,,ai chatbots accessed1 such as ,,ai chatbots designed for mental health1 educational1 or entertainment purposes or general purpose ,,ai chatbots that are engaged for such purposes4 7#c7 ,age of first use of1 and primary contexts of engagement with1 ,,ai chatbots4 7#d7 ,emotional1 psychological1 or behavioral impacts perceived by users of ,,ai chatbots4 7#e7 ,exposure to content that the user perceives to be harmful or inappropriate4 #i4 ,enforcement 7a7 ,enforcement by the ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #d1 #e1 or #f1 or a regulation promulgated thereunder1 shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce sections #d1 #e1 and #f and any regulation promulgated thereunder in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any deployer or developer that violates section #d1 #e1 or #f1 or a regulation promulgated thereunder1 shall be subject to the penalties1 and entitled to the privileges and immunities1 provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,c7 ,authority preserved ,nothing in this ,act shall be construed to limit the authority of the ,commission under any other provision of law4 7,d7 ,rulemaking ,in addition to the specific rulemaking requirements described in section #d1 the ,commission shall promulgate in accordance with section #eec of title #e1 ,united ,states ,code1 such rules as may be necessary to carry out this ,act4 7b7 ,enforcement by ,states 7#a7 ,authorization ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of the ,state has been or is threatened or adversely affected by the engagement of any deployer or developer in an act or practice that violates section #d1 #e1 or #f1 or a regulation promulgated thereunder1 the attorney general of the ,state may1 as parens patriae1 bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7,a7 enjoin such act or practice2 7,b7 enforce compliance with section #d1 #e or #f1 or a regulation promulgated thereunder2 7,c7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7,d7 obtain such other relief as the court may consider to be appropriate4 7#b7 ,rights of the ,commission 7,a7 ,notice to the ,commission 7i7 ,in general ,except as provided in clause 7iii71 before initiating a civil action under paragraph 7#a71 the attorney general of a ,state shall notify the ,commission in writing that the attorney general intends to bring such civil action4 7ii7 ,contents ,the notification required to be filed by clause 7i7 shall include a copy of the complaint to be filed to initiate the civil action4 7iii7 ,exception ,if it is not feasible for the attorney general of a ,state to provide the notification required by clause 7i7 before initiating a civil action under paragraph 7#a71 the attorney general shall notify the ,commission immediately upon instituting the civil action4 7,b7 ,intervention by the ,commission ,upon receiving the notice required by subparagraph 7,a71 the ,commission may intervene in the civil action and1 upon intervening-- 7i7 be heard on all matters arising in the civil action2 and 7ii7 file petitions for appeal of a decision in the civil action4 7,c7 ,preemptive action by the ,commission ,if the ,commission has instituted a civil action for a violation of subsection 7a71 no ,state officer may bring an action under paragraph 7#a7 during the pendency of that action against any defendant named in the complaint of the ,commission for any violation of subsection 7a7 alleged in the complaint4 7#c7 ,investigatory powers ,nothing in this subsection may be construed to prevent the attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of the ,state to conduct investigations1 to administer oaths or affirmations1 or to compel the attendance of witnesses or the production of documentary or other evidence4 7#d7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7c7 ,private right of action 7#a7 ,in general ,any parent or legal guardian of a minor may bring a civil action in any court of competent jurisdiction against a deployer or developer for a violation of section #d or #e1 or a regulation promulgated thereunder1 by the deployer or developer4 7#b7 ,relief ,in a civil action brought under paragraph 7#a7 in which the plaintiff prevails1 the court may award-- 7,a7 actual damages2 7,b7 punitive damages2 7,c7 reasonable attorney's fees and litigation costs2 7,d7 injunctive relief or declaratory relief2 or 7,e7 any other relief that the court determines appropriate4 7d7 ,relationship to ,state law ,the provisions of this ,act shall preempt any ,state law1 rule1 or regulation only to the extent that such ,state law1 rule1 or regulation conflicts with a provision of this ,act4 ,nothing in this ,act shall be construed to prohibit any ,state from enacting a law1 rule1 or regulation that provides greater protection to minors than the provisions of this ,act4 7e7 ,severability ,if any provision of this ,act1 or the application thereof to any person or circumstance1 is held invalid1 the remainder of this ,act1 and the application of such provision to other persons not similarly situated or to other circumstances1 shall not be affected by the invalidation4 #aj4 ,determination of whether an ,,ai chatbot deployer has knowledge fairly implied on the basis of objective circumstances that an individual is a minor 7a7 ,rules of construction ,for purposes of enforcing this ,act or a regulation promulgated thereunder1 in making a determination as to whether a deployer has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen1 the ,commission or the attorney general of a ,state1 as applicable1 shall rely on competent and reliable evidence1 taking into account the totality of the circumstances1 including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen4 ,nothing in this ,act1 including a determination described in the preceding sentence1 shall be construed to require a deployer to-- 7#a7 affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business2 or 7#b7 implement an age gating or age verification functionality4 7b7 ,commission guidance 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall issue guidance to provide information for deployers to understand the ,commission's determination of whether a deployer has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen1 including best practices and examples4 7#b7 ,limitation ,no guidance issued by the ,commission with respect to this ,act shall confer any rights on any person1 ,state1 or locality1 nor shall operate to bind the ,commission or any person to the approach recommended in such guidance4 ,in any enforcement action brought pursuant to this ,act1 the ,commission or the attorney general of a ,state1 as applicable1 shall allege a specific violation of a provision of this ,act4 ,the ,commission or the attorney general of a ,state1 as applicable1 may not base an enforcement action on1 or execute a consent order based on1 practices that are alleged to be inconsistent with any such guidance1 unless the practices allegedly violate this ,act4 ,for purposes of enforcing this ,act or a regulation promulgated thereunder1 the attorney general of a ,state shall take into account any guidance issued by the ,commission under paragraph 7#a74