AI chatbot operators would have to disclose AI use and add protections for minors

Each operator of a conversational AI service would have to clearly tell account holders they are interacting with AI. This applies to people or companies that make a chatbot-style AI service available to the public. The notice must be a persistent visible disclaimer, or appear at the start of each session and at least every three hours in a continuous conversation. Several tools are excluded, such as tools made for developers or researchers, business internal tools, business or government customer service tools, and shopping or transaction help. The chapter takes effect from and after September 30, 2027.

Operators would have to take reasonable steps to keep their chatbots from sexual content and, for minors, from acting human or romantic. Sexual content limits apply to every account holder. The human-like and romance limits apply to minors, meaning people the operator knows or is reasonably certain are under 18. For all users, chatbots must not make sexual images, tell users to engage in sexual conduct, or sexually objectify them. For minors, chatbots must not claim to be sentient or human, simulate emotional dependence or romantic or sexual hints, or role-play adult-minor romance. If an operator knows a user is a minor, it may not give points or rewards at unpredictable times to increase use.

Operators would need a plan to respond to users who mention suicide or self-harm, and could not claim their chatbot provides professional mental health care. The plan covers all users. The account tools are for minors and the parents or guardians of minors. The plan must make reasonable efforts to point users to crisis services such as a suicide hotline or crisis text line. Operators must take reasonable steps to stop the chatbot from encouraging, instructing, or glorifying suicide or self-harm. Operators must offer privacy and account tools to minors, and to a parent or guardian if the minor is under 13, which can stay on the device or account.

Operators could not require a digital ID system, such as government ID or face scans, just to find out whether a user is a minor. This applies to chatbot operators and to any personal or age-related data they collect to follow this law. Federal law that expressly requires a digital ID system is an exception. If an operator offers one by choice, it must also offer a privacy-preserving alternative with equal access. Age data must be limited to what is reasonably necessary, deleted or de-identified when done, and never used for ads, profiling, or secondary money-making. Government can get it only with a court warrant. Each year by April 1, operators must certify under penalty of perjury that the data was destroyed or de-identified, and publish a report on their age-check methods. Annual certification and reports are due on or before April 1 each year.

An operator that breaks the chapter could face an injunction and would owe the greater of actual damages or $1,000 per violation. This applies to chatbot operators. Total civil penalties are capped at $500,000 per operator. Only the attorney general can seek the civil penalty, and the section creates no private right to sue. The attorney general cannot expand the requirements by rule, guidance, enforcement action, or settlement, including by requiring identity checks or bulk data reporting. AI model developers are not liable for violations by a third-party operator that offers their model.