S. 4199 — Youth AI Privacy Act

This section sets forth nine congressional findings concerning risks to minors from artificial intelligence (AI) chatbots, including compulsive use, emotional dependency, anthropomorphic design features, covert advertising, harmful outputs, and privacy violations involving retention of sensitive personal data.

This section defines 17 terms for purposes of the Act, including "AI chatbot" (i.e., a natural language interface using a covered algorithm to simulate interpersonal interaction); "covered algorithm"; "deployer" and "developer" (not mutually exclusive); "input data," "output," and "derived data" with respect to AI chatbots; "personal data" (excluding publicly available information); "collect," "process," and "transfer" of personal data; "profiling"; "knowledge"; and "minor" (under age 18). It further defines "publicly available information" and "widely distributed media" to expressly exclude obscene visual depictions (as used in 18 U.S.C. §1460, i.e., images—not mere words—for which federal criminal penalties apply for knowing sale or possession with intent to sell in specified jurisdictions), along with biometric or genetic information, nonconsensual intimate images, and other categories.

This section requires a deployer with knowledge that an AI chatbot user is a minor to disclose (1) that the user is not interacting with a human and (2) that any content is AI-generated, with disclosures in clear language suited to minors, at the start of every session (as defined by the Commission), at least every 30 minutes thereafter, and appropriate for the medium. It directs the Commission to promulgate regulations within one year of enactment to (1) prohibit such deployers from processing the minor's personal data to generate or personalize outputs unless the data was collected in the current session more recently than a maximum period set by the Commission; and (2) prohibit such deployers or developers from configuring AI chatbots for minors to include features encouraging compulsive use, including (A) rewards or incentives based on frequency of use, time spent, or activity; (B) notifications or push alerts other than required disclosures; (C) badges or visual awards based on usage; (D) outputs generated without user-initiated input or engagement solicitations; and (E) usage traces mimicking human interactions (e.g., typing bubbles or online indicators).

This section prohibits deployers and developers of AI chatbots, upon knowledge that a user is a minor, from (1) configuring the chatbot to advertise to the minor or to generate outputs that promote, market, recommend, or endorse products or services where such output is materially influenced by a financial connection to the seller; and (2) processing the minor's personal data for profiling purposes. It further prohibits deployers, upon such knowledge, from processing or transferring the minor's personal data to train a covered algorithm, except to test for or address risks of harm to users. Finally, beginning 30 days after the Commission's issuance of regulations under section 4(b)(1), it prohibits deployers from processing a minor's input data to an AI chatbot except to generate, personalize, or affect outputs during the current session (as defined by the Commission) within the maximum permitted period established under section 4(b)(2), or to test for or address risks of harm to users.

This section prohibits a deployer or developer from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating or retaliating against an individual for raising a concern regarding a violation of this Act, reporting or attempting to report such a violation, or cooperating in an investigation or enforcement proceeding under the Act.

This section expands research requirements under Section 1432 of the Restoring Hope for Mental Health and Well-Being Act of 2022 (42 U.S.C. 285g–11)—directed at the Eunice Kennedy Shriver National Institute of Child Health and Human Development (NICHD), which conducts and supports research on child health and human development—by adding AI chatbots to the technologies whose health and developmental effects on minors must be studied (i.e., after augmented reality in the list). It further authorizes appropriations of $50 million for each of fiscal years 2027 through 2030 to carry out this section.

This section directs the Secretary of Health and Human Services, acting through the Director of the Centers for Disease Control and Prevention (CDC) and in coordination with the Director of the National Institutes of Health, to incorporate questions on youth and adult use of AI chatbots into national health and behavioral surveys conducted by the department, including the Household Pulse Survey—which tracks household health, economic well-being, and social impacts—and the CDC's Youth Risk Behavior Surveillance System (YRBSS), which monitors health-risk behaviors among high school students. These questions must address (1) frequency and duration of AI chatbot use; (2) types of AI chatbots accessed, such as those designed for mental health, educational, or entertainment purposes or general-purpose AI chatbots used for such purposes; (3) age of first use and primary contexts of engagement; (4) perceived emotional, psychological, or behavioral impacts; and (5) exposure to content perceived as harmful or inappropriate.

This section establishes Federal Trade Commission (FTC) enforcement authority by treating violations of sections 4, 5, or 6, or regulations thereunder, as violations of an FTC rule defining unfair or deceptive acts or practices under 15 U.S.C. 57a(a)(1)(B); grants the FTC the same enforcement powers, jurisdiction, penalties, privileges, and immunities as under the FTC Act (15 U.S.C. 41 et seq.); preserves other FTC authorities; and requires the FTC to promulgate necessary implementing rules under 5 U.S.C. 553. This section authorizes state attorneys general to bring parens patriae civil actions in federal district court to enjoin violations of sections 4, 5, or 6 or obtain compliance, damages, restitution, or other relief for state residents; requires advance notice to the FTC (with an exception for infeasible cases); permits FTC intervention and appeal rights; preempts state actions if the FTC has already sued the same defendant for the same violations; and preserves state investigatory powers with specified venue and service rules. This section creates a private right of action allowing parents or legal guardians of minors to sue deployers or developers in any court of competent jurisdiction for violations of section 4 or 5, or regulations thereunder, with courts authorized to award actual or punitive damages, attorney’s fees and costs, injunctive or declaratory relief, or other appropriate remedies. This section preempts state laws, rules, or regulations only to the extent they conflict with the Act but permits states to impose greater protections for minors; and includes a severability clause.

This section establishes standards for the Federal Trade Commission (FTC) or a state attorney general to determine, for enforcement purposes, whether an AI chatbot deployer has knowledge fairly implied from objective circumstances that a user is a child or teen, based on competent evidence and the totality of circumstances (i.e., what a reasonable and prudent person would know). It clarifies that the Act does not require deployers to (1) affirmatively collect age-related personal information beyond normal business practices or (2) implement age gating or verification; and it directs the FTC to issue non-binding guidance within 180 days of enactment on such determinations, including best practices and examples, which state attorneys general must consider but cannot form the sole basis for enforcement absent a specific Act violation.