Consumer chatbots would limit human-like behavior when minors may use them

Developers would design covered chatbots to begin in a setting that avoids human-like claims and relationships, and providers would activate it for known or likely minors. The design duty covers open-ended consumer chatbots developers know or reasonably should know will reach minors. Narrow-purpose and workplace-only software is excluded. The setting must clearly say the chatbot is AI and block claims that it is human, alive, or a licensed professional. It also must block simulated personal relationships, pressure to keep chatting, and requests to spend money to preserve an emotional bond. Natural language, warmth, humor, safety help, and certain educational or creative role-play would remain allowed. The design and default-setting duties would take effect one year after enactment.

Parents or legal guardians would control changes to a minor's default setting; authorized educators could adjust school-managed accounts. The school option covers institution-controlled accounts, not chatbot accounts that minors create or control independently. A school adjustment must serve a real educational purpose and apply only to accounts provided by the school. Developers and providers may not pressure covered users to weaken the setting or lie about their age. Providers must reasonably confirm that a parent or legal guardian manages the controls; a person's unsupported claim is not enough. The parental-control and anti-pressure rules would take effect one year after enactment.

Developers and providers could qualify for limited exceptions by barring chatbot access or deployment to minors. A developer's exception applies to a provider's particular deployment. A provider's exception applies to a chatbot it does not direct toward minors. Developers must prohibit minor use by contract, obtain the provider's promise to comply, and lack knowledge of a violation. Providers must ban minors, require users to state they are adults, avoid targeting minors, prevent blocked minors from returning, and never encourage age lies. Companies need not use a particular age check or collect new personal data, but they must consider age information they already hold or may use. Developers must cut off an uncured violating provider within 14 days after learning of the violation; providers must block known minors within 48 hours and likely minors within 14 days.

The FTC would enforce the main developer, provider, and anti-pressure rules; state officials could bring civil cases for residents. Penalties could be counted separately for each affected minor and for each chatbot version, provider, and deployment covered by the developer rule. Courts could stop violations and award damages, refunds, other compensation, or other relief. No civil penalty would apply while a company materially follows the applicable federal guidance. An isolated bad response alone would not prove failure when the company followed the testing guidance and promptly fixed its cause. NIST would publish interim voluntary guidance within 6 months and final voluntary guidance within 18 months after enactment.