Family account requirement for children; termination of existing user accounts and profiles; deletion of personal data

(a) Creation and maintenance of family accounts A covered entity shall require an individual to create and maintain a family account that meets the requirements described in section 5 to access an artificial intelligence chatbot of the covered entity if the covered entity knows such individual is a child. (b) Termination of existing user accounts and profiles of child and teen users A covered entity shall terminate any user account or profile of an artificial intelligence chatbot of the covered entity that exists as of the effective date of this Act if the covered entity knows such user is— (1) a child and such child has not created a family account; or (2) a teen and the parent of such teen has not provided verifiable parental consent pursuant to section 4(a)(1). (c) Deletion of personal data of children and teens (1) In general Subject to paragraph (2), upon termination of a user account or profile pursuant to subsection (b), a covered entity shall immediately delete all personal data collected from the user or submitted by the user (including data of the user collected from or submitted by the parent of such user) to the artificial intelligence chatbot of such entity. (2) Access of children and teens to personal data During the 90-day period beginning on the date on which a covered entity terminates a user account or profile pursuant to subsection (b), to the extent technically feasible and not in violation of any licensing agreement, the covered entity shall make available to such user or parent of such user, upon request, a copy of the personal data collected from the user or submitted by the user to the artificial chatbot of such entity in— (A) a manner that is readable and able to be understood by a reasonable person; and (B) a portable, structured, and machine-readable format. (3) Rule of construction Nothing in this subsection shall be construed to prohibit a covered entity from retaining— (A) a record of the termination of a user account or profile; and (B) the minimum information necessary for ensuring compliance with this section.