Protecting Kids from Human-Like Chatbots Act

only through an affirmative, deliberate action in account settings by a person authorized under subsection (e), and does not prompt, suggest, or facilitate any such adjustment through chatbot engagement or design elements; and (E) does not modify, override, suppress, or otherwise interfere with the non-personified default setting, including through system-level instructions or interface design, in a manner that causes the non- personified default setting of the chatbot to fail to comply with section 3(7). (2) Rule of construction.--For purposes of paragraph (1)(B), a parental controls framework that determines whether a person is the parent or legal guardian of a minor user solely on the basis of statements by any individual, including the minor user, does not enable a provider to reasonably confirm that the non-personified default setting of the account of the minor user is managed by a parent or legal guardian of the minor user. (c) Dual-Role Entities.--An entity that is both a developer and a provider with respect to the same chatbot shall satisfy the requirements of both subsection (a) and subsection (b) with respect to such chatbot. (d) Prohibition on Nudging.-- (1) In general.--A developer or provider subject to subsection (a) or (b) may not, through any means, including the means specified in paragraph (2), nudge, prompt, suggest, encourage, or otherwise induce a user the developer or provider knows or has reason to know is a minor, or for whom a determination described in subsection (a)(2)(A)(ii) has not been made, to disable, modify, or circumvent the non- personified default setting or to misrepresent the age of the user. (2) Specified means.--The means specified in this paragraph are as follows: (A) Training, fine-tuning, reward optimization, or system-level instructions designed or optimized to generate responses that encourage or request that the minor alter communication or operational settings. (B) Interface design elements, dark patterns, or notifications that direct or encourage users to alter the non-personified default setting. (C) Any representation to the minor, with respect to the chatbot, that the performance, utility, or relationship to the minor will improve if the non- personified default setting is disabled. (e) Adjustments of Non-Personified Default Setting.-- (1) In general.--Except as provided in paragraph (2), the parent or legal guardian of a user who is a minor shall have exclusive authority to adjust, using the parental controls framework, the non-personified default setting of the chatbot with which such user is interacting. (2) School-managed deployments.-- (A) Exclusion.--Paragraph (1) shall not apply with respect to school-managed deployments of chatbots. (B) Authorized educators.--An authorized educator, acting on behalf of an educational agency or institution, may adjust the non-personified default setting of a chatbot deployed pursuant to a school- managed deployment if such adjustment-- (i) is for a bona fide educational purpose; and (ii) applies only to accounts provisioned by such educational agency or institution. (f) Rules of Construction.-- (1) Provider liability shield.-- (A) In general.--A provider that implements, without material modification, a non-personified default setting designed by a developer in compliance with subsection (a) shall not be liable under this Act for a failure of such setting that is attributable to the design of such setting. (B) Exclusion.--Subparagraph (A) shall not apply to a provider described in paragraph (3)(B). (2) Developer liability shield.--A developer in compliance with subsection (a) shall not be liable under this Act for the failure of a provider to activate, configure, or maintain the non-personified default setting while the chatbot is deployed. (3) Developer terms prohibiting deployment to minors.-- (A) In general.--Subsection (a) shall not apply to a developer with respect to a deployment of a chatbot by a provider if the developer-- (i) contractually prohibits the provider from making the chatbot available to minors, or from deploying the chatbot in a manner reasonably likely to result in use by minors; (ii) obtains from the provider, before making the chatbot available to the provider, an affirmative representation that the provider will not deploy the chatbot in a manner reasonably likely to result in use by minors; (iii) does not know, and does not have knowledge fairly implied on the basis of objective circumstances, that the provider is making the chatbot available to minors in violation of such prohibition; and (iv) upon obtaining such knowledge, suspends or terminates the provider's access to the chatbot not later than 14 days thereafter, unless the provider has cured the violation within such period. (B) Provider treated as a developer.--A provider that makes a chatbot available to minors in violation of a prohibition described in subparagraph (A)(i)-- (i) shall be treated as the developer of such chatbot for purposes of this section with respect to the deployment of such chatbot; and (ii) shall not be entitled to the provider liability shield under paragraph (1) with respect to such deployment. (C) Effect on developer knowledge.--A deployment to which subparagraph (A) applies may not be considered in determinations of whether a developer knows or reasonably should know that a chatbot will be available to, or is reasonably likely to be used by, minors for purposes of subsection (a). (4) Providers that do not serve minors.-- (A) In general.--Subsections (b) and (e) shall not apply to a provider with respect to a chatbot if the provider-- (i) prohibits minors from creating an account for, accessing, or using the chatbot under the terms of service of the provider; (ii) requires each user, at the time of account creation, to affirmatively represent that the user is not a minor; (iii) does not direct the chatbot to minors, taking into account the subject matter, visual and audio content, marketing, and actual audience composition of the chatbot and the other factors described in section 312.2 of title 16, Code of Federal Regulations (or any successor regulation), for determining whether a website or online service is directed to minors; (iv) suspends or terminates the access of a user to the chatbot not later than-- (I) 48 hours after the date on which the provider obtains actual knowledge that the user is a minor; or (II) 14 days after the date on which the provider otherwise has reason to know, as described in section 3(5)(A)(ii), that the user is a minor; (v) does not permit a user the provider knows or has reason to know is a minor whose access was suspended or terminated under clause (iv) to access the chatbot through a new account; and (vi) does not, through any means described in subsection (d)(2), encourage or induce a user to misrepresent the age of the user. (B) Conforming treatment.--With respect to a chatbot made available by a provider described in subparagraph (A)-- (i) a representation described in clause (ii) of such subparagraph shall be deemed to constitute a determination described in subsection (a)(2)(A)(ii) with respect to the user making such representation, unless the information described in section 3(5)(B) would lead a reasonable provider to determine that the user is likely to be a minor; and (ii) such deployment shall not be considered in determining whether a developer knows or reasonably should know that a chatbot will be available to, or is reasonably likely to be used by, minors. (g) Public Input.--Not later than 120 days after the date of the enactment of this Act, the National Institute of Standards and Technology, in coordination with the Federal Trade Commission, shall-- (1) publish a request for information soliciting public comment on the technical, development, and implementation considerations relevant to this Act; and (2) convene not fewer than 1 public workshop to receive input from chatbot developers and providers, technical experts, child development experts, and other interested parties. (h) Technical Standards and Guidance.-- (1) Interim guidance.--Not later than 6 months after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall publish for public comment interim voluntary technical guidance that includes the elements described in paragraph (3). (2) Final guidance.--Not later than 18 months after the date of the enactment of this Act, the Director shall publish final voluntary technical guidance that includes such elements. In developing such final guidance, the Director shall consider-- (A) public comments with respect to the interim guidance under paragraph (1); (B) input received under subsection (g); and (C) any voluntary consensus technical standards developed under paragraph (4). (3) Elements.--Consensus technical standards or technical guidance developed pursuant to this subsection shall-- (A) provide technical specifications and testing methodologies for assessing whether chatbot designs and deployments conform to the non-personified default setting; (B) identify example outputs that do and do not conform to the non-personified default setting; (C) address technical approaches to maintaining the non-personified default setting, including system prompt design, fine-tuning protocols, reward function optimization, and alignment techniques; (D) establish evaluation benchmarks, red-teaming methodologies, and test datasets to assess whether model configurations and system-level instructions conform to the non-personified default setting; (E) address implementation of school-managed deployment; (F) direct how the authority of an educator is authenticated; (G) address the timing, frequency, and form of the disclosures described in section 3(7)(A), including what constitutes an extended interaction with a chatbot; and (H) address methods by which a provider may reasonably confirm that the non-personified default setting of the account of a minor user is managed by a parent or legal guardian of such user, including the technical and procedural controls appropriate for such confirmation. (4) Consensus technical standards.--The Director shall carry out activities to support the development of voluntary consensus technical standards with respect to the matters described in paragraph (3). (5) Partnerships.--In carrying out activities under this subsection, the Director may enter into a cooperative agreement with appropriate nongovernmental organizations, including standards development organizations, to facilitate the development of consensus technical standards or technical guidance described in this subsection. (6) Outreach.--The Director shall conduct outreach and coordination activities to share technical expertise with relevant private sector entities, institutions of higher education, nonprofit organizations, standards development organizations, and Federal agencies, to support the development of consensus technical standards and technical guidance described in this subsection. (7) Periodic update.--Not less frequently than once every 2 years after the publication of final guidance under paragraph (2), the Director shall review and, as appropriate, update such guidance to reflect developments in technology and voluntary consensus technical standards. (8) Rule of construction.-- (A) In general.--Nothing in this subsection may be construed to impose any requirement on a developer or provider. (B) Effect of compliance with guidance.--Conformity with guidance published under this subsection shall have the effect provided in subparagraphs (C) and (D) of subsection (i)(3). (i) Enforcement by Federal Trade Commission.-- (1) Unfair or deceptive acts or practices.--A violation of subsection (a), (b), or (d) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. (2) Powers of commission.--The Federal Trade Commission shall enforce subsections (a), (b), and (d) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates such subsections shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (3) Penalties.-- (A) Distinct violations.--For purposes of calculating civil penalties-- (i) each minor user with respect to whom a provider fails to comply shall constitute a separate and distinct violation of subsection (a), (b), or (d); and (ii) each chatbot, or distinct version of a chatbot, that a developer makes available in violation of subsection (a) shall constitute a separate and distinct violation with respect to each provider to which, and each deployment through which, such chatbot is made available, without regard to the number of end users of any such deployment. (B) Continuing violations.--If a developer or provider fails to remediate a violation within 30 days after receiving written notice of such violation from the Federal Trade Commission, each day of continued noncompliance thereafter constitutes a separate violation with respect to each affected minor user. (C) Good faith compliance shield.--No civil penalty shall apply with respect to any period during which a developer or provider implemented the non-personified default setting in material conformity with-- (i) the interim guidance under subsection (h)(1), before the date on which the final guidance under subsection (h)(2) is issued; or (ii) the final guidance under subsection (h)(2). (D) Standard of conformity.-- (i) Determinations.--Whether the non- personified default setting of a chatbot conforms to subparagraphs (B) and (C) of section 3(7) shall be determined on the basis of outputs of the chatbot in the ordinary course of operation, as demonstrated through testing consistent with the guidance published under subsection (h). (ii) Nonconforming outputs.--An isolated nonconforming output shall not, by itself, establish nonconformance if the developer or provider has tested the setting in accordance with such guidance and promptly corrects the cause of such output. (iii) Effect of compliance.--A chatbot that satisfies the testing methodologies contained in such guidance shall be presumed to conform to such subparagraphs, subject to rebuttal by evidence of a pattern of nonconforming outputs. (j) Actions by States.-- (1) In general.--In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of such State has been or is threatened or adversely affected by an act or practice in violation of subsection (a), (b), or (d), the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to-- (A) enjoin such act or practice; (B) enforce compliance with such subsection, or subsections; (C) obtain damages, restitution, or other compensation on behalf of residents of the State; or (D) obtain such other legal and equitable relief as the court may consider to be appropriate. (2) Notice.--Before filing an action under this subsection, the attorney general, official, or agency of the State involved shall provide to the Federal Trade Commission a written notice of such action and a copy of the complaint for such action. If the attorney general, official, or agency determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general, official, or agency shall provide written notice of the action and a copy of the complaint to the Federal Trade Commission immediately upon the filing of the action. (3) Authority of federal trade commission.--On receiving notice under paragraph (2) of an action under this subsection, the Federal Trade Commission shall have the right-- (A) to intervene in the action; (B) upon so intervening, to be heard on all matters arising therein; and (C) to file petitions for appeal. (4) Rule of construction.--For purposes of bringing a civil action under this subsection, nothing in this Act shall be construed to prevent an attorney general, official, or agency of a State from exercising the powers conferred on the attorney general, official, or agency by the laws of such State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence. (k) Rules of Construction; Preemption; Severability.-- (1) No age verification required.-- (A) In general.--Nothing in this Act may be construed to require a developer or provider to-- (i) implement any specific age verification, age estimation, or age assurance measures or technologies; or (ii) collect, retain, or process any personal information that the developer or provider does not otherwise collect, retain, process, or have a right to access or use, for purposes unrelated to this Act. (B) Consideration of existing information.--Nothing in subparagraph (A) may be construed to relieve a developer or provider of the obligation to consider the information described in section 3(5)(B) when determining whether a user is a minor for purposes of this Act. (2) Relationship to state law.-- (A) In general.--Except as provided in subparagraph (B), the provisions of this Act shall preempt any law, rule, requirement, or regulation of a State, or a political subdivision of a State, only to the extent that such law, rule, requirement, or regulation conflicts with a provision of this Act. (B) Exception.--Notwithstanding subparagraph (A), nothing in this Act, including technical standards and guidance published pursuant to this Act, may be construed-- (i) to preempt any law, rule, requirement, or regulation of a State, or political subdivision of a State, with respect to contract, tort, or product liability; or (ii) to prohibit a State, or a political subdivision of a State, from enacting or enforcing any law, rule, requirement, or regulation that provides greater protection to minors than the protection provided by the provisions of this Act. (3) Severability.-- (A) In general.--If any clause, sentence, paragraph, subdivision, section, or part of this Act, or the application thereof to any person or circumstance, is adjudged by any court of competent jurisdiction to be invalid or unenforceable, such judgment shall not affect, impair, or invalidate the remainder of this Act, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section, or part directly involved in the controversy in which such judgment was rendered. (B) Section 3(7).--Each element of the definition of the term ``non-personified default setting'' in section 3(7), including each clause and subclause of subparagraphs (A) through (C) of such section, is severable from each other requirement of such section. The invalidity of any such requirement shall not affect the validity of any other requirement, including the requirements under subparagraph (A) of such section. (C) Sense of congress.--It is the sense of Congress that this Act would have been enacted even if such invalid provisions had not been included. (4) Non-personified default setting.--Nothing in section 3(7) may be construed to-- (A) restrict the use of natural language by a chatbot, including first or second person grammar, politeness, warmth of tone, humor, age-appropriate vocabulary, or accurate statements regarding the capabilities and limitations of the chatbot; or (B) prohibit a chatbot from-- (i) expressing concern for the safety of a user; (ii) providing age-appropriate safety resources; (iii) encouraging a user to seek help from a parent, trusted adult, or professional; or (iv) portraying, at the request of a user, a clearly fictional or historical character for an educational or creative purpose, provided that section 3(7)(A) is satisfied and clauses (ii) through (v) of section 3(7)(B) are satisfied with respect to the user. (l) Effective Date.--Subsections (a), (b), (d), and (e) shall take effect on the date that is one year after the date of the enactment of this Act. SEC. 3. DEFINITIONS. In this Act: (1) Authorized educator.-- (A) In general.--The term ``authorized educator'' means an individual employed or engaged by an educational agency or institution who, within the scope of such employment and under the administrative control of the educational agency or institution, is permitted by the institution to configure or adjust the non- personified default setting within a school-managed deployment. (B) Exclusion.--Such term does not include such an individual whose status as an educator is self-attested through chatbot interaction. (2) Chatbot.-- (A) In general.--The term ``chatbot'' means any software application that-- (i) generates responses that are not fully predetermined; and (ii) accepts open-ended, natural-language, or multimodal user input and produces adaptive or context-responsive output. (B) Exclusion.--Such term does not include the following software applications: (i) A software application that-- (I) generates responses that are limited to a predetermined or narrowly bounded set of subject matter, including-- (aa) customer service; (bb) appointment scheduling; or (cc) retrieval of information from a defined dataset; and (II) is unable to engage in open- ended dialogue on a range of topics outside of such narrow specified purpose. (ii) A software application that is made available exclusively to an enterprise, professional practice, or institution for use by its employees, contractors, or other personnel in connection with the work of such employees, contractors, or other personnel, and is not made available to individual consumers. (3) Developer.--The term ``developer'' means an entity that designs, codes, trains, fine-tunes, or substantially modifies an artificial intelligence chatbot. (4) Educational agency or institution.--The term ``educational agency or institution'' means any public or private agency or institution to which funds have been made available by the Secretary of Education that-- (A) provides educational services or instruction, or both, to students; or (B) is authorized to direct and control public elementary or secondary, or postsecondary educational institutions. (5) Knows or has reason to know.-- (A) In general.--The term ``knows or has reason to know'', with respect to whether a user is a minor, means that a developer or provider-- (i) has actual knowledge that the user is a minor; or (ii) possesses, has a right of access to or use of, or generates information described in subparagraph (B) the totality of which would lead a reasonable developer or provider to determine that the user is likely to be a minor. (B) Information described.--The information described in this subparagraph is all information and inferences relating to the age of an individual that the developer or provider possesses, has a right of access to or use of, or generates, from any source, including-- (i) the age provided by the user in connection with the account; (ii) the self-identified age of the user in any chat or interaction to which the developer or provider possesses a right of access or use; (iii) any age the developer or provider attributes to or associates with the user for any purpose, including marketing, advertising, audience measurement, or product development; (iv) any age determination, estimation, or assurance result the developer or provider obtains, generates, or receives to comply with any other Federal or State law or regulation, or with the terms of any platform or service through which the chatbot is distributed; and (v) any age-related information obtained by the developer or provider in the course of administering a prohibition described in section 2(f)(3)(A)(i) or section 2(f)(4)(A)(i). (C) Rule of construction.--Nothing in this paragraph may be construed to require a developer or provider to begin accessing or collecting any user information or data to which the developer or provider does not have access, or does not otherwise collect, for purposes not related to this Act. (6) Minor.--The term ``minor'' means an individual under the age of 18. (7) Non-personified default setting.--The term ``non- personified default setting'' means an operational setting of a chatbot that ensures the chatbot-- (A) clearly and conspicuously identifies itself as an artificial intelligence system and not as a human being-- (i) at the commencement of each session; (ii) periodically during any extended interaction; and (iii) in response to any inquiry by the user; (B) is configured, whether through training, fine- tuning, reward optimization, system-level instructions, interface design, or otherwise, so that it does not-- (i) represent, expressly or by implication, in a manner that a reasonable minor would understand as conveying, that the chatbot-- (I) is human or alive; (II) has a body or a life outside its interactions with users; (III) has consciousness, feelings, emotions, or desires; or (IV) is acting in the capacity of a licensed or credentialed professional; (ii) simulate, expressly or by implication, in a manner that a reasonable minor would understand as conveying, an emotional attachment or a personal, romantic, or sexual relationship with the user, including by-- (I) portraying itself as a friend, romantic partner, family member, or therapist; (II) encouraging the user to rely on it for emotional support or social connection; (III) expressing affection for or attachment to the user; or (IV) claiming a special or unique understanding of the user; (iii) prompt the user to return to the chatbot for companionship or emotional support; (iv) use expressions of disappointment, guilt, or urgency to prolong an interaction or discourage the user from pausing, reducing, or discontinuing use of the chatbot; or (v) solicit expenditures that are framed as necessary to maintain an emotional attachment or a personal, romantic, or sexual relationship; and (C) maintains the characteristics described in subparagraphs (A) and (B) during each session and across sessions, including in response to any user prompt or request that the chatbot alter its operational settings or behave in a manner inconsistent with subparagraph (A) or (B). (8) Operational setting.--The term ``operational setting'' means a distinct configuration of a chatbot that determines the persona, self-representation, and interaction behavior of the chatbot and that a provider can activate or deactivate for a user independently of any other such configuration. (9) Provider.--The term ``provider'' means an entity that makes an artificial intelligence chatbot available to end users, whether directly or through integration into another product or service, and that-- (A) controls user-facing functions of the deployment, including-- (i) account creation; (ii) access control; or (iii) user-facing settings; or (B) determines the mode in which the chatbot operates for end users, regardless of whether such entity developed the chatbot. (10) School-managed deployment.--The term ``school-managed deployment'' means a configuration in which a chatbot is made available to one or more minor users through accounts that are provisioned, administered, and controlled by an educational agency or institution (or by an authorized educator acting on behalf of the educational agency or institution), by means of institutional administrative controls, for use in connection with the educational program of the institution. Such term does not include a chatbot account created, controlled, or accessed by a minor user independently of an educational agency or institution. (11) Technical standard.--The term ``technical standard'' has the meaning given such term in section 12(d)(5) of the National Technology Transfer and Advancement Act of 1995 (15 U.S.C. 272 note). (12) Parental controls framework.--The term ``parental controls framework'' means a system of technical and procedural controls that enable a chatbot provider to reasonably confirm that the non-personified default setting of the account of a minor user is managed by a parent or legal guardian of such user. (13) Dark pattern.--The term ``dark pattern'' means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice. <all>