Data privacy protections

(a) Prohibition on advertising and promotion A deployer or developer with knowledge that a user of an AI chatbot is a minor shall not configure or modify an AI chatbot to— (1) advertise to such user; or (2) generate an output that promotes, markets, recommends, or endorses a product or service to such user if the weight or credibility of such promotion, marketing, recommendation, or endorsement is materially affected by a financial connection between the deployer or developer and the seller of such product or service. (b) Prohibition on processing of personal data for profiling A deployer with knowledge that a user of an AI chatbot is a minor shall not process any personal data of the user to engage in any profiling of such user. (c) Prohibition on the processing or transferring of personal data To train a covered algorithm (1) In general Except as provided in paragraph (2), a deployer with knowledge that a user of an AI chatbot is a minor shall not— (A) process the personal data of such minor for the purpose of training a covered algorithm; or (B) transfer the personal data of such minor to a third party for the purpose of training a covered algorithm. (2) Exceptions A deployer with knowledge that a user of an AI chatbot is a minor may process personal data of such minor for the express purpose of— (A) testing and identifying risks of harm to users; or (B) addressing identified risks of harm to users. (d) Prohibition on processing of input data Beginning on the date that is 30 days after the Commission promulgates regulations under section 4(b)(1), a deployer with knowledge that a user of an AI chatbot is a minor shall not process any input data provided to such AI chatbot by such user for any purpose, other than for the express purpose of— (1) generating, personalizing, or affecting an output provided to such user when the input data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under section 4(b)(2); (2) testing and identifying risks of harm to users; or (3) addressing identified risks of harm to users.