S. 4199

119 S4199 IS: Youth AI Privacy Act
 U.S. Senate
 2026-03-25
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 II  119th CONGRESS  2d Session  S. 4199  IN THE SENATE OF THE UNITED STATES   March 25, 2026   Mr. Markey  introduced the following bill; which was read twice and referred to the  Committee on Commerce, Science, and Transportation    A BILL
To require entities that make artificial intelligence chatbots available to minors to implement certain safe design features, and for other purposes.
1.
Short title
This Act may be cited as the   Youth AI Privacy Act  .
2.
Findings
Congress finds the following:
(1)
Millions of teenagers are using artificial intelligence (referred to in this section as  AI ) chatbots for personal, sensitive conversations, disclosing intimate details about their lives, relying on AI chatbots for advice, and developing deep emotional bonds with AI chatbots.
(2)
In 2025, approximately  2/3  of teenagers reported using AI chatbots, and roughly  1/4  reported using them daily.  1/3  of teens have chosen to speak with AI chatbot  companions  over a real human for a serious conversation. In a couple tragic cases, a teenager died by suicide after encouragement or advice from an AI chatbot.
(3)
Although compulsive use of AI chatbots may pose risks for all users, users who are minors, whose cognitive, emotional, and social capabilities are still developing, are especially likely to misunderstand that an AI chatbot is not a real human and disclose sensitive personal information to the AI chatbot or turn to the AI chatbot for social companionship. Minors are also more susceptible to addictive design features, anthropomorphized systems, and potentially harmful outputs generated by AI systems.
(4)
AI chatbot companies are employing manipulative engagement features to keep users engaged on their platforms, including high-frequency push notifications, unprompted AI chatbot responses, typing bubble indicators, and more. These features create serious risks of emotional dependency and compulsive use among minors.
(5)
AI chatbots mimic human-like conversations by employing profiling tactics to personalize outputs for users. AI chatbots are also often designed to resemble direct messaging user interfaces. These personalization strategies and anthropomorphic design features can easily confuse users, especially minors, who may believe they are interacting with a real person rather than AI.
(6)
Advertisements delivered through AI chatbots may be woven directly into responses or may subtly steer users toward certain products based on how the model was trained. This advertising would be far more covert and harder to recognize than traditional digital advertising, especially for minors. As highlighted by the Commission, many young users lack the skills or cognitive defenses needed to identify such covert or  blurred  advertising.
(7)
Extended, multiturn conversations with AI chatbots degrade safeguards against harmful conversational patterns, increasing the likelihood of minors receiving harmful outputs generated by AI systems.
(8)
AI chatbots introduce new privacy risks, as they often retain user inputs and personal data to personalize responses and to train the underlying large language models. This practice creates the potential for serious privacy violations, particularly when companies retain and process highly sensitive information from minors.
(9)
Congress has a responsibility to address the novel risks posed by AI chatbots and protect minors from potential harm related to anthropomorphism, prolonged engagement, deceptive advertising, and invasive privacy practices.
3.
Definitions
In this Act:
(1)
AI chatbot
The term  AI chatbot  means a natural language interface that uses a covered algorithm to provide adaptive responses to user inputs via text, audio, image, video, or any other mode of communication, simulating interpersonal interaction with a user.
(2)
Collect
The term  collect  means, with respect to personal data, to buy, rent, gather, obtain, receive, access, or otherwise acquire the personal data by any means.
(3)
Commission
The term  Commission  means the Federal Trade Commission.
(4)
Covered algorithm
The term  covered algorithm  means a computational process derived from machine learning, natural language processing, neural networks, or other technology of similar or greater complexity.
(5)
Deployer
(A)
In general
The term  deployer  means any person that owns, operates, or otherwise makes available to users an AI chatbot in or affecting interstate commerce.
(B)
Rule of construction
The terms  deployer  and  developer  shall not be interpreted to be mutually exclusive.
(6)
Derived data
The term  derived data  means data that is created by the derivation of information, other data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information.
(7)
Developer
(A)
In general
The term  developer  means any person that designs, codes, produces, or substantially modifies a covered algorithm for use in an AI chatbot.
(B)
Rule of construction
The terms  developer  and  deployer  shall not be interpreted to be mutually exclusive.
(8)
Input data
The term  input data  means, with respect to an AI chatbot, all information, including text, photos, audio, video, or files, provided to the AI chatbot by a user of such AI chatbot.
(9)
Knowledge
The term  knowledge  means actual knowledge or knowledge fairly implied on the basis of objective circumstances.
(10)
Minor
The term  minor  means an individual who is under the age of 18.
(11)
Output
The term  output  means, with respect to an AI chatbot, any information, including any text, photo, audio recording, video, or file, provided by such AI chatbot to a user.
(12)
Personal data
The term  personal data —
(A)
means information, including input data, derived data, inferences, or unique identifiers, that identifies or is linked, or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked, or reasonably linkable, to 1 or more individuals; and
(B)
does not include publicly available information.
(13)
Profiling
The term  profiling  means processing data for the purpose of detecting and classifying or designating personality and behavioral characteristics of a user of an AI chatbot.
(14)
Process
The term  process  means, with respect to personal data, any operation or set of operations performed on the personal data, including analyzing, organizing, structuring, using, modifying, or otherwise handling such data.
(15)
Publicly available information
(A)
In general
The term  publicly available information —
(i)
means any information that a deployer has a reasonable basis to believe has been made available to the general public by—
(I)
Federal, State, or local government records;
(II)
widely distributed media;
(III)
a website or online service made available to any member of the public, for free or for a fee, including a website or online service that any member of the public can log into; or
(IV)
a disclosure to the general public that is required under Federal, State, or local law; and
(ii)
does not include—
(I)
any obscene visual depiction (as such term is used in section 1460 of title 18, United States Code);
(II)
biometric information;
(III)
genetic information, unless made publicly available by the individual to whom the information pertains by a means described in subclause (II) or (III) of clause (i);
(IV)
personal data that is created through the combination of personal data with publicly available information;
(V)
intimate images that are authentic or computer-generated, known to be nonconsensual; or
(VI)
personal data made available by a data broker.
(B)
Clarification
For purposes of this paragraph, information from a website or online service is not available to any member of the public if the individual to whom the information pertains has restricted the information to a specific audience or maintained a default setting that restricts the information to a specific audience.
(16)
Transfer
The term  transfer  means, with respect to personal data, to disclose, release, share disseminate, make available, sell, rent, or license the personal data (orally, in writing, electronically, or by any other means).
(17)
Widely distributed media
The term  widely distributed media —
(A)
means information that is available to the general public, including information from a telephone book or online directory, a television, internet, or radio program, the news media, or an internet site, that is available to the general public on an unrestricted basis; and
(B)
does not include an obscene visual depiction (as such term is used in section 1460 of title 18, United States Code).
4.
Safe design features
(a)
Required disclosures
(1)
In general
A deployer with knowledge that a user of an AI chatbot is a minor shall disclose that—
(A)
the user is not interacting with a human; and
(B)
any content provided by the AI chatbot is generated by artificial intelligence.
(2)
Content and duration of disclosure
A disclosure made by a deployer pursuant to paragraph (1) shall—
(A)
be stated in clear, plain, and easy-to-understand language suited to the age of minors likely to access the AI chatbot;
(B)
occur at the beginning of every session (as defined by the Commission);
(C)
reoccur not less than once every 30 minutes during a session (as so defined); and
(D)
be appropriate for the medium of the content, as determined by the Commission.
(b)
Limitation on the processing of personal data To provide outputs
(1)
In general
Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer with knowledge that a user of an AI chatbot is a minor from processing any personal data of the user to generate, personalize, or otherwise affect an output provided to such user, unless the personal data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under paragraph (2).
(2)
Maximum permitted period of use
In promulgating the regulations described in paragraph (1), the Commission shall determine a maximum permitted period of use during which a deployer with knowledge that a user of an AI chatbot is a minor may collect personal data from such a user and process such data to generate, personalize, or otherwise affect an output (as defined by the Commission) provided to such user during a current session (as defined by the Commission).
(c)
Exclusion of features that encourage compulsive use
Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations to prohibit a deployer or developer with knowledge that a user of an AI chatbot is a minor from configuring such AI chatbot to include, with respect to such user, the following features:
(1)
Any reward or incentive based on the frequency of use, time spent, or activity using the AI chatbot.
(2)
Notifications and push alerts, other than a disclosure required by subsection (a).
(3)
Any badge or other visual award symbol based on the frequency of use, time spent, or activity using the AI chatbot.
(4)
Generation of an output absent a user-initiated input or any form of solicitation of engagement from a user.
(5)
Usage traces that mimic social interactions with a human, such as typing bubbles or indicators showing that the AI chatbot is available or online.
5.
Data privacy protections
(a)
Prohibition on advertising and promotion
A deployer or developer with knowledge that a user of an AI chatbot is a minor shall not configure or modify an AI chatbot to—
(1)
advertise to such user; or
(2)
generate an output that promotes, markets, recommends, or endorses a product or service to such user if the weight or credibility of such promotion, marketing, recommendation, or endorsement is materially affected by a financial connection between the deployer or developer and the seller of such product or service.
(b)
Prohibition on processing of personal data for profiling
A deployer with knowledge that a user of an AI chatbot is a minor shall not process any personal data of the user to engage in any profiling of such user.
(c)
Prohibition on the processing or transferring of personal data To train a covered algorithm
(1)
In general
Except as provided in paragraph (2), a deployer with knowledge that a user of an AI chatbot is a minor shall not—
(A)
process the personal data of such minor for the purpose of training a covered algorithm; or
(B)
transfer the personal data of such minor to a third party for the purpose of training a covered algorithm.
(2)
Exceptions
A deployer with knowledge that a user of an AI chatbot is a minor may process personal data of such minor for the express purpose of—
(A)
testing and identifying risks of harm to users; or
(B)
addressing identified risks of harm to users.
(d)
Prohibition on processing of input data
Beginning on the date that is 30 days after the Commission promulgates regulations under section 4(b)(1), a deployer with knowledge that a user of an AI chatbot is a minor shall not process any input data provided to such AI chatbot by such user for any purpose, other than for the express purpose of—
(1)
generating, personalizing, or affecting an output provided to such user when the input data was collected during the current session (as defined by the Commission) more recently than the maximum permitted period of use established by the Commission under section 4(b)(2);
(2)
testing and identifying risks of harm to users; or
(3)
addressing identified risks of harm to users.
6.
Whistleblower protections
A deployer or developer may not, directly or indirectly, discharge, demote, suspend, threaten, harass, or otherwise discriminate or retaliate against an individual for raising a concern regarding a violation of this Act, reporting or attempting to report a violation of this Act, or cooperating in any investigation or enforcement proceeding pursuant to this Act.
7.
Research on the health and developmental effects of AI chatbots on minors
Section 1432 of the Restoring Hope for Mental Health and Well-Being Act of 2022 ( 42 U.S.C. 285g–11 ) is amended—
(1)
in subsection (a), by inserting,  AI chatbots,  after  augmented reality, ; and
(2)
by adding at the end the following:
(e)
Authorization of appropriations
To carry out this section, there are authorized to be appropriated $50,000,000 for each of fiscal years 2027 through 2030.
 .
8.
Survey inclusion requirement
The Secretary of Health and Human Services, acting through the Director of the Centers for Disease Control and Prevention and in coordination with the Director of the National Institutes of Health, shall incorporate questions related to the use, by youth and by adults, of AI chatbots into national health and behavioral surveys conducted by the Department of Health and Human Services, including the Household Pulse Survey and the Youth Risk Behavior Surveillance System of the Centers for Disease Control and Prevention, including questions designed to capture the following:
(1)
Frequency and duration of AI chatbot uses.
(2)
Types of AI chatbots accessed, such as AI chatbots designed for mental health, educational, or entertainment purposes or general purpose AI chatbots that are engaged for such purposes.
(3)
Age of first use of, and primary contexts of engagement with, AI chatbots.
(4)
Emotional, psychological, or behavioral impacts perceived by users of AI chatbots.
(5)
Exposure to content that the user perceives to be harmful or inappropriate.
9.
Enforcement
(a)
Enforcement by the Commission
(1)
Unfair or deceptive acts or practices
A violation of section 4, 5, or 6, or a regulation promulgated thereunder, shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ).
(2)
Powers of the Commission
(A)
In general
The Commission shall enforce sections 4, 5, and 6 and any regulation promulgated thereunder in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this Act.
(B)
Privileges and immunities
Any deployer or developer that violates section 4, 5, or 6, or a regulation promulgated thereunder, shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ).
(C)
Authority preserved
Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.
(D)
Rulemaking
In addition to the specific rulemaking requirements described in section 4, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.
(b)
Enforcement by States
(1)
Authorization
In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any deployer or developer in an act or practice that violates section 4, 5, or 6, or a regulation promulgated thereunder, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—
(A)
enjoin such act or practice;
(B)
enforce compliance with section 4, 5 or 6, or a regulation promulgated thereunder;
(C)
obtain damages, restitution, or other compensation on behalf of residents of the State; or
(D)
obtain such other relief as the court may consider to be appropriate.
(2)
Rights of the Commission
(A)
Notice to the Commission
(i)
In general
Except as provided in clause (iii), before initiating a civil action under paragraph (1), the attorney general of a State shall notify the Commission in writing that the attorney general intends to bring such civil action.
(ii)
Contents
The notification required to be filed by clause (i) shall include a copy of the complaint to be filed to initiate the civil action.
(iii)
Exception
If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Commission immediately upon instituting the civil action.
(B)
Intervention by the Commission
Upon receiving the notice required by subparagraph (A), the Commission may intervene in the civil action and, upon intervening—
(i)
be heard on all matters arising in the civil action; and
(ii)
file petitions for appeal of a decision in the civil action.
(C)
Preemptive action by the Commission
If the Commission has instituted a civil action for a violation of subsection (a), no State officer may bring an action under paragraph (1) during the pendency of that action against any defendant named in the complaint of the Commission for any violation of subsection (a) alleged in the complaint.
(3)
Investigatory powers
Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.
(4)
Venue; service of process
(A)
Venue
Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
(B)
Service of process
In an action brought under paragraph (1), process may be served in any district in which the defendant—
(i)
is an inhabitant; or
(ii)
may be found.
(c)
Private right of action
(1)
In general
Any parent or legal guardian of a minor may bring a civil action in any court of competent jurisdiction against a deployer or developer for a violation of section 4 or 5, or a regulation promulgated thereunder, by the deployer or developer.
(2)
Relief
In a civil action brought under paragraph (1) in which the plaintiff prevails, the court may award—
(A)
actual damages;
(B)
punitive damages;
(C)
reasonable attorney's fees and litigation costs;
(D)
injunctive relief or declaratory relief; or
(E)
any other relief that the court determines appropriate.
(d)
Relationship to State law
The provisions of this Act shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this Act. Nothing in this Act shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to minors than the provisions of this Act.
(e)
Severability
If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the remainder of this Act, and the application of such provision to other persons not similarly situated or to other circumstances, shall not be affected by the invalidation.
10.
Determination of whether an AI chatbot deployer has knowledge fairly implied on the basis of objective circumstances that an individual is a minor
(a)
Rules of construction
For purposes of enforcing this Act or a regulation promulgated thereunder, in making a determination as to whether a deployer has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen, the Commission or the attorney general of a State, as applicable, shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen. Nothing in this Act, including a determination described in the preceding sentence, shall be construed to require a deployer to—
(1)
affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or
(2)
implement an age gating or age verification functionality.
(b)
Commission guidance
(1)
In general
Not later than 180 days after the date of enactment of this Act, the Commission shall issue guidance to provide information for deployers to understand the Commission’s determination of whether a deployer has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen, including best practices and examples.
(2)
Limitation
No guidance issued by the Commission with respect to this Act shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this Act, the Commission or the attorney general of a State, as applicable, shall allege a specific violation of a provision of this Act. The Commission or the attorney general of a State, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this Act. For purposes of enforcing this Act or a regulation promulgated thereunder, the attorney general of a State shall take into account any guidance issued by the Commission under paragraph (1).