Determination of user age

(a) Treatment of unverified users (1) In general Except as provided in paragraph (2), a provider of an AI chatbot shall treat any user as a child for purposes of all restrictions, protections, and requirements under this Act. (2) Exception for verified adults Paragraph (1) shall not apply to a user if the provider of an AI chatbot has verified, pursuant to the standards of this section, that the user has attained 18 years of age. (b) Age estimation requirement (1) In general A provider of an AI chatbot— (A) shall implement age estimation technology to distinguish an account that is held by a child from an account that is held by an adult; and (B) may contract with a third party to employ such technology, but the use of such a third party shall not relieve the provider of its obligations under this Act or from liability under this Act. (2) Age signal treated as actual age A provider of an AI chatbot shall treat any age signal received from the age estimation technology required under paragraph (1) as the actual age range of the user, except that— (A) if the age signal indicates that the user has attained 18 years of age, but the provider has actual knowledge that the user is a child or reasonably should have known the user is a child, the provider shall treat the user as a child; and (B) if the age signal indicates the user is a child, the provider may treat the user as an adult only if it has actual knowledge that the user has attained 18 years of age. (3) Other alternatives to age estimation (A) In general A provider of an AI chatbot may use an age signal obtained from a source other than the age estimation technology required under paragraph (1) if the provider of an AI chatbot— (i) receives an age signal from the provider of an operating system or application store regarding the age range of a user; and (ii) does not possess information that conflicts with such age signal. (B) Conflict In the case of conflicting age signals, the provider shall treat the age signal that indicates the younger age as the actual age range of the user. (c) Periodic age estimation A provider of an AI chatbot shall periodically review each user account associated with the AI chatbot using the age estimation technology required under this section to ensure compliance with the requirements of this Act. (d) Data security A provider of an AI chatbot— (1) shall— (A) establish, implement, and maintain reasonable data security measures to limit the collection of personal information to that which is minimally necessary to maintain compliance with the requirements of this Act; (B) protect such data against unauthorized access; and (C) protect the integrity and confidentiality of such data by only transmitting such data using industry-standard encryption protocols; and (2) shall not— (A) retain age estimation data for longer than is reasonably necessary to maintain compliance with the requirements of this Act; (B) use such data for any purpose other than age estimation; and (C) share or sell such data to any other entity. (e) Deemed compliance through comparable age assurance frameworks A provider of an AI chatbot shall be deemed to be in compliance with the requirements of this section if the provider has implemented, to the satisfaction of the Commission, an age assurance framework that meets the requirements of a substantially similar foreign, Federal, or State law on age assurance.