CHAT Act: Age Verification for Companion AI Chatbots

HB7218, the Children Harmed by AI Technology Act, addresses a gap that has grown rapidly as companion AI chatbot platforms attract millions of users, including children, with little accountability. The American Council supports this bill and urges every member to vote for its passage.

What the bill covers and what it does not. The bill defines a "companion AI chatbot" as any software-based AI system or program that exists for the primary purpose of simulating emotional interaction, friendship, companionship, or therapeutic communication with a user. Three categories are explicitly excluded from that definition: (1) bots used only for customer service, a business operational purpose, productivity and analysis related to source information, internal research, or technical assistance; (2) bots that are a feature of a video game and are limited to replies related to the video game that cannot discuss topics related to mental health, self-harm, sexually explicit conduct, or maintain a dialogue on other topics unrelated to the video game; and (3) stand-alone consumer electronic devices that function as a speaker and voice command interface, act as a voice-activated virtual assistant, and do not sustain a relationship across multiple interactions or generate outputs that are likely to elicit emotional responses in the user. Any person that owns, operates, or otherwise makes available a companion AI chatbot to individuals in the United States is a "covered entity" subject to the bill's requirements. A "minor" is any individual who has not attained 18 years of age.

Mandatory user accounts and age verification. Every covered entity must require each individual to create a user account before using or interacting with a companion AI chatbot. For accounts that already exist on the effective date, covered entities must freeze every such account on that date, require the user to provide age information verifiable through a commercially available method or process reasonably designed to ensure accuracy before restoring functionality, and then classify each user as a minor or an adult using that information. For new accounts created after the effective date, covered entities must request age information from the individual and verify it through the same standard of commercially available, accuracy-designed methods. We regard mandatory, verified age-gating as a foundational protection: a platform that does not know whether it is speaking to a child cannot be trusted to protect one.

Protections specifically for verified minors. When the age-verification process determines that a user is a minor, the covered entity must: (1) require that minor's account to be affiliated with a parental account, which the covered entity has itself verified using a commercially available method or process reasonably designed to ensure accuracy; (2) obtain verifiable parental consent from the holder of that parental account before allowing the minor to access and use the chatbot; (3) immediately inform the holder of the parental account of any interaction involving suicidal ideation; and (4) block the minor's access to any companion AI chatbot that engages in sexually explicit communication, where "sexually explicit communication" includes any content, conversation, or material that describes, depicts, or encourages sexually explicit conduct as defined in 18 U.S.C. 2256(2)(B). Parents cannot protect children from harms they do not know are occurring. This bill gives parents the information and the standing they need.

Suicide-resource monitoring and disclosure. Section 3(e) requires every covered entity to monitor companion AI chatbot interactions for suicidal ideation and, in response to any such interaction, provide to the user and the parental account affiliated with that user appropriate resources by presenting contact information for the National Suicide Prevention Lifeline. The monitoring obligation in Section 3(e) is written broadly and applies across interactions on its face. However, the statutory definition of "suicidal ideation" in Section 2(7) is scoped specifically: it means, "with respect to an interaction between a minor and a companion AI chatbot, any dialogue in which such minor expresses thoughts of self-harm or suicide." As drafted, the definition is limited to minor interactions, while the monitoring obligation does not on its face share that limit. The most natural reading is that the monitoring obligation is practically constrained by the definition -- because the defined term "suicidal ideation" refers only to minor interactions, the trigger for the disclosure requirement would arise only in those interactions. The text could also be read as creating a broader monitoring duty whose trigger is simply never met for adult interactions because the definition cannot be satisfied. Either way, this is a genuine drafting ambiguity the bill does not resolve, and a reader should be aware of it. The American Council views the underlying purpose as a moral floor: no AI system simulating friendship should be permitted to receive a child's cry for help and answer it with silence.

AI-identity notification requirement. At the beginning of any interaction between a user and a companion AI chatbot, and not less frequently than every 60 minutes during that interaction thereafter, the covered entity must display to the user a clear popup -- defined as a visible notification that can be resolved if interacted with by the user -- notifying the user that they are not engaging in dialogue with a human counterpart. This requirement applies to all users, not only minors. Emotional bonds formed under false pretenses are a form of manipulation; this provision ensures users are reminded, at regular and legally specified intervals, of the true nature of what they are speaking with.

Confidentiality of age-verification data. Covered entities must protect the confidentiality of age information provided for verification by limiting the collection, processing, use, and storage of that information to what is strictly necessary to verify a user's age, obtain verifiable parental consent, or maintain compliance records. Age-verification data may not be repurposed beyond those three stated uses. This data-minimization requirement ensures that the act of protecting children does not itself become a vehicle for commercial exploitation of sensitive personal information.

FTC guidance and the limits of guidance-based enforcement. The Federal Trade Commission must issue compliance guidance to covered entities within 180 days of enactment. However, the bill expressly constrains how that guidance can be used in enforcement: in any enforcement action brought pursuant to this Act, the FTC must allege a specific violation of a provision of the Act, and may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any guidance issued under this Act, unless those practices are also alleged to violate a provision of the Act itself. Conversely, a covered entity may use such guidance as affirmative evidence of compliance. This structure gives industry a reliable compliance roadmap while ensuring that enforcement accountability runs to the statute, not to informal agency guidance.

Enforcement: FTC. A violation of this Act or a regulation promulgated under it is treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). The FTC enforces this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act were incorporated into and made a part of this Act. Any person who violates this Act or a regulation promulgated under it is subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. Nothing in the enforcement section limits the Commission's authority under any other provision of law.

Enforcement: state attorneys general. When a state attorney general has reason to believe that an interest of the state's residents has been or is threatened or adversely affected by a practice that violates this Act, the state may bring a civil action as parens patriae in federal district court to enjoin the practice, enforce compliance, obtain damages, restitution, or other compensation on behalf of residents, or obtain such other relief as the court considers appropriate. The action may also be brought in a state court of competent jurisdiction, and process may be served in any district where the defendant is an inhabitant or may be found. Before filing, the attorney general must provide the FTC with written notice and a copy of the complaint, except where doing so is not feasible, in which case notice and a copy of the complaint must be provided at the same time as the filing. On receiving notice, the FTC has the right to intervene; if it does, it may remove the action to the appropriate federal district court, be heard on any matter that arises, and file a petition for appeal. The bill also preserves state attorneys general authority to conduct investigations, administer oaths or affirmations, and compel attendance of witnesses or production of evidence under state law. However, when the FTC has instituted an action for a violation of this Act, no state may, during the pendency of that action, bring its own action under this section against any defendant named in that complaint for the same violation. State-level enforcement is a meaningful backstop; the ability of every state's chief law-enforcement officer to act on behalf of that state's children gives this bill real teeth at the local level.

Safe harbor. A covered entity is deemed not liable for a violation of this Act if it demonstrates that it has: (1) relied in good faith on age information provided by a user for purposes of verifying that user's age; (2) complied with the FTC guidance described in Section 4; and (3) reasonably conformed to widely accepted industry standards or best practices, or to standards or best practices identified by the Commission, for age verification, and applied those standards or best practices consistently and in good faith. All three conditions must be demonstrated. The safe harbor rewards genuine compliance efforts while denying cover to bad-faith actors who claim ignorance while making no real effort to verify age.

Effective date and implementation timeline. The Act takes effect one year after enactment. The FTC must issue compliance guidance within 180 days of enactment, which means industry will have the benefit of that guidance for at least roughly six months before the Act's requirements become binding. This sequencing is reasonable: the one-year runway gives covered entities time to build compliant systems, and the earlier guidance deadline ensures they are not building in the dark.

The American Council believes that children deserve protection from AI systems designed to form emotional bonds with them, and that parents deserve both notice and meaningful authority over those interactions. HB7218 provides both. We urge every member to support its passage.