Limitation on personified chatbots available to minors for use

(a) Developer requirements (1) In general Except as provided in subsection (f)(3), it shall be unlawful for a developer to make a chatbot that does not satisfy the requirements of paragraph (2) available as a service for deployment to consumers that such developer knows, or reasonably should know, will be available to, or is reasonably likely to be used by, a minor. (2) Requirements A chatbot that satisfies the requirements of this subsection is a chatbot that— (A) is designed— (i) to support the non-personified default setting; (ii) so that the non-personified default setting is active upon the first interaction of any user with the chatbot, unless a reasonable determination has been made, on the basis of the totality of the information described in section 3(5)(B), that the user is not a minor; (iii) to require no action from a minor, or a parent or a legal guardian of a minor to enable the non-personified default setting; and (iv) in a manner that ensures the non-personified default setting and any other operational setting are technically separable, such that a provider can activate the non-personified default setting for a minor user and restrict the access of such user to any other operational setting; and (B) is capable of preventing the non-personified default setting from being disengaged with respect to a user for whom a determination described in subparagraph (A)(ii) has not been made. (b) Provider requirements (1) In general Except as provided in subsection (f)(4), a provider may not make a chatbot available to end users unless, with respect to such chatbot, the provider— (A) ensures that, with respect to any user the provider knows or has reason to know is a minor, the default operational setting of the chatbot is the non-personified default setting; (B) maintains a parental controls framework that enables a parent or legal guardian, or, with respect to a school-managed deployment, the educational agency or institution or an authorized educator acting on behalf of such agency or institution, to manage the non-personified default setting, and settings related to such setting, with respect to the account of a user the provider knows or has reason to know is a minor; (C) includes an account framework capable of supporting the non-personified default setting and the parental controls framework, except with respect to a deployment in which the non-personified default setting is the only operational setting available to any user and cannot be disengaged; (D) permits the non-personified default setting to be adjusted only through an affirmative, deliberate action in account settings by a person authorized under subsection (e), and does not prompt, suggest, or facilitate any such adjustment through chatbot engagement or design elements; and (E) does not modify, override, suppress, or otherwise interfere with the non-personified default setting, including through system-level instructions or interface design, in a manner that causes the non-personified default setting of the chatbot to fail to comply with section 3(7). (2) Rule of construction For purposes of paragraph (1)(B), a parental controls framework that determines whether a person is the parent or legal guardian of a minor user solely on the basis of statements by any individual, including the minor user, does not enable a provider to reasonably confirm that the non-personified default setting of the account of the minor user is managed by a parent or legal guardian of the minor user. (c) Dual-Role entities An entity that is both a developer and a provider with respect to the same chatbot shall satisfy the requirements of both subsection (a) and subsection (b) with respect to such chatbot. (d) Prohibition on nudging (1) In general A developer or provider subject to subsection (a) or (b) may not, through any means, including the means specified in paragraph (2), nudge, prompt, suggest, encourage, or otherwise induce a user the developer or provider knows or has reason to know is a minor, or for whom a determination described in subsection (a)(2)(A)(ii) has not been made, to disable, modify, or circumvent the non-personified default setting or to misrepresent the age of the user. (2) Specified means The means specified in this paragraph are as follows: (A) Training, fine-tuning, reward optimization, or system-level instructions designed or optimized to generate responses that encourage or request that the minor alter communication or operational settings. (B) Interface design elements, dark patterns, or notifications that direct or encourage users to alter the non-personified default setting. (C) Any representation to the minor, with respect to the chatbot, that the performance, utility, or relationship to the minor will improve if the non-personified default setting is disabled. (e) Adjustments of non-Personified default setting (1) In general Except as provided in paragraph (2), the parent or legal guardian of a user who is a minor shall have exclusive authority to adjust, using the parental controls framework, the non-personified default setting of the chatbot with which such user is interacting. (2) School-managed deployments (A) Exclusion Paragraph (1) shall not apply with respect to school-managed deployments of chatbots. (B) Authorized educators An authorized educator, acting on behalf of an educational agency or institution, may adjust the non-personified default setting of a chatbot deployed pursuant to a school-managed deployment if such adjustment— (i) is for a bona fide educational purpose; and (ii) applies only to accounts provisioned by such educational agency or institution. (f) Rules of construction (1) Provider liability shield (A) In general A provider that implements, without material modification, a non-personified default setting designed by a developer in compliance with subsection (a) shall not be liable under this Act for a failure of such setting that is attributable to the design of such setting. (B) Exclusion Subparagraph (A) shall not apply to a provider described in paragraph (3)(B). (2) Developer liability shield A developer in compliance with subsection (a) shall not be liable under this Act for the failure of a provider to activate, configure, or maintain the non-personified default setting while the chatbot is deployed. (3) Developer terms prohibiting deployment to minors (A) In general Subsection (a) shall not apply to a developer with respect to a deployment of a chatbot by a provider if the developer— (i) contractually prohibits the provider from making the chatbot available to minors, or from deploying the chatbot in a manner reasonably likely to result in use by minors; (ii) obtains from the provider, before making the chatbot available to the provider, an affirmative representation that the provider will not deploy the chatbot in a manner reasonably likely to result in use by minors; (iii) does not know, and does not have knowledge fairly implied on the basis of objective circumstances, that the provider is making the chatbot available to minors in violation of such prohibition; and (iv) upon obtaining such knowledge, suspends or terminates the provider’s access to the chatbot not later than 14 days thereafter, unless the provider has cured the violation within such period. (B) Provider treated as a developer A provider that makes a chatbot available to minors in violation of a prohibition described in subparagraph (A)(i)— (i) shall be treated as the developer of such chatbot for purposes of this section with respect to the deployment of such chatbot; and (ii) shall not be entitled to the provider liability shield under paragraph (1) with respect to such deployment. (C) Effect on developer knowledge A deployment to which subparagraph (A) applies may not be considered in determinations of whether a developer knows or reasonably should know that a chatbot will be available to, or is reasonably likely to be used by, minors for purposes of subsection (a). (4) Providers that do not serve minors (A) In general Subsections (b) and (e) shall not apply to a provider with respect to a chatbot if the provider— (i) prohibits minors from creating an account for, accessing, or using the chatbot under the terms of service of the provider; (ii) requires each user, at the time of account creation, to affirmatively represent that the user is not a minor; (iii) does not direct the chatbot to minors, taking into account the subject matter, visual and audio content, marketing, and actual audience composition of the chatbot and the other factors described in section 312.2 of title 16, Code of Federal Regulations (or any successor regulation), for determining whether a website or online service is directed to minors; (iv) suspends or terminates the access of a user to the chatbot not later than— (I) 48 hours after the date on which the provider obtains actual knowledge that the user is a minor; or (II) 14 days after the date on which the provider otherwise has reason to know, as described in section 3(5)(A)(ii), that the user is a minor; (v) does not permit a user the provider knows or has reason to know is a minor whose access was suspended or terminated under clause (iv) to access the chatbot through a new account; and (vi) does not, through any means described in subsection (d)(2), encourage or induce a user to misrepresent the age of the user. (B) Conforming treatment With respect to a chatbot made available by a provider described in subparagraph (A)— (i) a representation described in clause (ii) of such subparagraph shall be deemed to constitute a determination described in subsection (a)(2)(A)(ii) with respect to the user making such representation, unless the information described in section 3(5)(B) would lead a reasonable provider to determine that the user is likely to be a minor; and (ii) such deployment shall not be considered in determining whether a developer knows or reasonably should know that a chatbot will be available to, or is reasonably likely to be used by, minors. (g) Public input Not later than 120 days after the date of the enactment of this Act, the National Institute of Standards and Technology, in coordination with the Federal Trade Commission, shall— (1) publish a request for information soliciting public comment on the technical, development, and implementation considerations relevant to this Act; and (2) convene not fewer than 1 public workshop to receive input from chatbot developers and providers, technical experts, child development experts, and other interested parties. (h) Technical standards and guidance (1) Interim guidance Not later than 6 months after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall publish for public comment interim voluntary technical guidance that includes the elements described in paragraph (3). (2) Final guidance Not later than 18 months after the date of the enactment of this Act, the Director shall publish final voluntary technical guidance that includes such elements. In developing such final guidance, the Director shall consider— (A) public comments with respect to the interim guidance under paragraph (1); (B) input received under subsection (g); and (C) any voluntary consensus technical standards developed under paragraph (4). (3) Elements Consensus technical standards or technical guidance developed pursuant to this subsection shall— (A) provide technical specifications and testing methodologies for assessing whether chatbot designs and deployments conform to the non-personified default setting; (B) identify example outputs that do and do not conform to the non-personified default setting; (C) address technical approaches to maintaining the non-personified default setting, including system prompt design, fine-tuning protocols, reward function optimization, and alignment techniques; (D) establish evaluation benchmarks, red-teaming methodologies, and test datasets to assess whether model configurations and system-level instructions conform to the non-personified default setting; (E) address implementation of school-managed deployment; (F) direct how the authority of an educator is authenticated; (G) address the timing, frequency, and form of the disclosures described in section 3(7)(A), including what constitutes an extended interaction with a chatbot; and (H) address methods by which a provider may reasonably confirm that the non-personified default setting of the account of a minor user is managed by a parent or legal guardian of such user, including the technical and procedural controls appropriate for such confirmation. (4) Consensus technical standards The Director shall carry out activities to support the development of voluntary consensus technical standards with respect to the matters described in paragraph (3). (5) Partnerships In carrying out activities under this subsection, the Director may enter into a cooperative agreement with appropriate nongovernmental organizations, including standards development organizations, to facilitate the development of consensus technical standards or technical guidance described in this subsection. (6) Outreach The Director shall conduct outreach and coordination activities to share technical expertise with relevant private sector entities, institutions of higher education, nonprofit organizations, standards development organizations, and Federal agencies, to support the development of consensus technical standards and technical guidance described in this subsection. (7) Periodic update Not less frequently than once every 2 years after the publication of final guidance under paragraph (2), the Director shall review and, as appropriate, update such guidance to reflect developments in technology and voluntary consensus technical standards. (8) Rule of construction (A) In general Nothing in this subsection may be construed to impose any requirement on a developer or provider. (B) Effect of compliance with guidance Conformity with guidance published under this subsection shall have the effect provided in subparagraphs (C) and (D) of subsection (i)(3). (i) Enforcement by Federal Trade Commission (1) Unfair or deceptive acts or practices A violation of subsection (a), (b), or (d) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. (2) Powers of Commission The Federal Trade Commission shall enforce subsections (a), (b), and (d) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates such subsections shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (3) Penalties (A) Distinct violations For purposes of calculating civil penalties— (i) each minor user with respect to whom a provider fails to comply shall constitute a separate and distinct violation of subsection (a), (b), or (d); and (ii) each chatbot, or distinct version of a chatbot, that a developer makes available in violation of subsection (a) shall constitute a separate and distinct violation with respect to each provider to which, and each deployment through which, such chatbot is made available, without regard to the number of end users of any such deployment. (B) Continuing violations If a developer or provider fails to remediate a violation within 30 days after receiving written notice of such violation from the Federal Trade Commission, each day of continued noncompliance thereafter constitutes a separate violation with respect to each affected minor user. (C) Good faith compliance shield No civil penalty shall apply with respect to any period during which a developer or provider implemented the non-personified default setting in material conformity with— (i) the interim guidance under subsection (h)(1), before the date on which the final guidance under subsection (h)(2) is issued; or (ii) the final guidance under subsection (h)(2). (D) Standard of conformity (i) Determinations Whether the non-personified default setting of a chatbot conforms to subparagraphs (B) and (C) of section 3(7) shall be determined on the basis of outputs of the chatbot in the ordinary course of operation, as demonstrated through testing consistent with the guidance published under subsection (h). (ii) Nonconforming outputs An isolated nonconforming output shall not, by itself, establish nonconformance if the developer or provider has tested the setting in accordance with such guidance and promptly corrects the cause of such output. (iii) Effect of compliance A chatbot that satisfies the testing methodologies contained in such guidance shall be presumed to conform to such subparagraphs, subject to rebuttal by evidence of a pattern of nonconforming outputs. (j) Actions by States (1) In general In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of such State has been or is threatened or adversely affected by an act or practice in violation of subsection (a), (b), or (d), the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to— (A) enjoin such act or practice; (B) enforce compliance with such subsection, or subsections; (C) obtain damages, restitution, or other compensation on behalf of residents of the State; or (D) obtain such other legal and equitable relief as the court may consider to be appropriate. (2) Notice Before filing an action under this subsection, the attorney general, official, or agency of the State involved shall provide to the Federal Trade Commission a written notice of such action and a copy of the complaint for such action. If the attorney general, official, or agency determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general, official, or agency shall provide written notice of the action and a copy of the complaint to the Federal Trade Commission immediately upon the filing of the action. (3) Authority of Federal Trade Commission On receiving notice under paragraph (2) of an action under this subsection, the Federal Trade Commission shall have the right— (A) to intervene in the action; (B) upon so intervening, to be heard on all matters arising therein; and (C) to file petitions for appeal. (4) Rule of construction For purposes of bringing a civil action under this subsection, nothing in this Act shall be construed to prevent an attorney general, official, or agency of a State from exercising the powers conferred on the attorney general, official, or agency by the laws of such State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence. (k) Rules of construction; preemption; severability (1) No age verification required (A) In general Nothing in this Act may be construed to require a developer or provider to— (i) implement any specific age verification, age estimation, or age assurance measures or technologies; or (ii) collect, retain, or process any personal information that the developer or provider does not otherwise collect, retain, process, or have a right to access or use, for purposes unrelated to this Act. (B) Consideration of existing information Nothing in subparagraph (A) may be construed to relieve a developer or provider of the obligation to consider the information described in section 3(5)(B) when determining whether a user is a minor for purposes of this Act. (2) Relationship to State law (A) In general Except as provided in subparagraph (B), the provisions of this Act shall preempt any law, rule, requirement, or regulation of a State, or a political subdivision of a State, only to the extent that such law, rule, requirement, or regulation conflicts with a provision of this Act. (B) Exception Notwithstanding subparagraph (A), nothing in this Act, including technical standards and guidance published pursuant to this Act, may be construed— (i) to preempt any law, rule, requirement, or regulation of a State, or political subdivision of a State, with respect to contract, tort, or product liability; or (ii) to prohibit a State, or a political subdivision of a State, from enacting or enforcing any law, rule, requirement, or regulation that provides greater protection to minors than the protection provided by the provisions of this Act. (3) Severability (A) In general If any clause, sentence, paragraph, subdivision, section, or part of this Act, or the application thereof to any person or circumstance, is adjudged by any court of competent jurisdiction to be invalid or unenforceable, such judgment shall not affect, impair, or invalidate the remainder of this Act, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section, or part directly involved in the controversy in which such judgment was rendered. (B) Section 3(7) Each element of the definition of the term non-personified default setting in section 3(7), including each clause and subclause of subparagraphs (A) through (C) of such section, is severable from each other requirement of such section. The invalidity of any such requirement shall not affect the validity of any other requirement, including the requirements under subparagraph (A) of such section. (C) Sense of Congress It is the sense of Congress that this Act would have been enacted even if such invalid provisions had not been included. (4) Non-personified default setting Nothing in section 3(7) may be construed to— (A) restrict the use of natural language by a chatbot, including first or second person grammar, politeness, warmth of tone, humor, age-appropriate vocabulary, or accurate statements regarding the capabilities and limitations of the chatbot; or (B) prohibit a chatbot from— (i) expressing concern for the safety of a user; (ii) providing age-appropriate safety resources; (iii) encouraging a user to seek help from a parent, trusted adult, or professional; or (iv) portraying, at the request of a user, a clearly fictional or historical character for an educational or creative purpose, provided that section 3(7)(A) is satisfied and clauses (ii) through (v) of section 3(7)(B) are satisfied with respect to the user. (l) Effective date Subsections (a), (b), (d), and (e) shall take effect on the date that is one year after the date of the enactment of this Act.