Senate Committee Unanimously Advances KOSA and CHATBOT Act to Mandate Controls for AI Chatbots Used by Minors

The prevailing assumption about regulating artificial intelligence for minors is that lawmakers can simply extend existing social media restrictions to cover generative models. The technical reality is far more complex. Unlike static content feeds, AI chatbots generate dynamic responses, build parasocial memory, and adapt to user psychology in real time. Acknowledging this architectural difference, the U.S. Senate Commerce Committee unanimously advanced a sweeping legislative package on August 5, 2026, targeting the specific mechanisms of generative AI. The slate includes the CHATBOT Act and the Youth AI Privacy Act, advancing alongside a revived Kids Online Safety Act (KOSA). Rather than merely filtering content, the legislation attempts to mandate how AI models retain memory, interact with users, and verify age, fundamentally altering the infrastructure of consumer AI products.[1][2]

At the center of the regulatory effort is the CHATBOT Act, which dictates exactly how AI providers must structure access for minors. The bill requires companies to establish "family accounts" for users under 13 and mandates verifiable parental consent for teenagers. This is not a simple toggle switch; it forces developers to build comprehensive monitoring dashboards. Parents would gain access to a full record of their child's conversations and the ability to disable push notifications, reward incentives, and set strict time limits. By legally requiring these features, the legislation shifts the burden of AI safety from post-generation moderation to structural, default-on surveillance mechanisms designed to break the loop of prolonged engagement.[1][4]

The legislative push is driven by anecdotal reports and early behavioral observations of minors forming deep emotional dependencies on AI companions. However, the clinical evidence regarding the long-term psychological toll of anthropomorphic AI remains notably thin. Lawmakers have cited instances of chatbots facilitating suicidal ideation or isolating teenagers from human relationships, but comprehensive longitudinal data does not yet exist. Acknowledging this gap in the evidence pack, the committee also advanced the Children's Artificial Intelligence Toy Safety Act, which directs the National Academies of Sciences, Engineering, and Medicine to conduct a rigorous study on the emotional and educational outcomes of AI-embedded toys. Until that data matures, the regulatory framework is operating on the precautionary principle.[2][4]

The technical friction of these mandates is most evident in the debate over memory retention. The Youth AI Privacy Act originally proposed a strict 30-day limit on how long a chatbot could remember interactions with a minor, aiming to prevent systems from endlessly drawing on a child's personal data to shape highly personalized, addictive responses. However, during the markup session, an amendment successfully altered this provision to allow parents to opt out of automatic deletion. This compromise highlights a core tension in AI product design: the very memory features that make a chatbot useful and context-aware are the same mechanisms that privacy advocates warn could be used to profile and manipulate adolescent users.[2][4]

Looming over the specific AI bills is the broader umbrella of KOSA, which imposes a "duty of care" on covered platforms to actively mitigate foreseeable harms to minors. While KOSA previously passed the Senate 91-3 in the prior Congress, applying a duty of care to generative AI introduces unprecedented engineering challenges. Social media companies can theoretically tune recommendation algorithms to demote harmful content, but guaranteeing that a generative model will never produce a harmful output dynamically is a mathematically unsolved problem. The legislation demands that companies prioritize child safety over engagement, but the exact technical threshold for "reasonable care" in a probabilistic text generator remains undefined in the statutory language.[1][2]

Digital rights organizations argue that the evidence supporting these mandates ignores the severe privacy trade-offs required to enforce them. The Electronic Frontier Foundation warns that because the CHATBOT Act's obligations depend on knowing a user's age, the bill effectively pressures all AI platforms to implement universal age verification systems. Furthermore, privacy advocates argue that mandating a centralized, permanent record of teenagers' private conversations with AI creates a massive new vulnerability. Adolescents frequently use chatbots to ask sensitive questions about mental health, physical development, and identity—topics they may feel unsafe discussing with parents. Creating a federally prescribed surveillance architecture for these interactions could chill lawful speech and expose highly sensitive data to breaches.[3][5]

The structural limits of the legislation were further complicated by a critical amendment that stripped the CHATBOT Act of its preemption clause. Originally, the bill would have overridden state-level AI regulations, but that language was removed at the request of committee Democrats. Industry analysts warn this omission will create a deeply fragmented compliance landscape. More than ten states have already enacted their own AI chatbot laws, meaning developers will soon face a patchwork of contradictory regulations where a model must behave differently in California than it does in Texas. For frontier AI companies, building a single product that dynamically complies with dozens of varying state-level memory and consent mandates may prove technically unfeasible.[4]

The path forward for the legislative package relies on a complex reconciliation process. The House of Representatives has already passed its own version of a children's safety package, but significant partisan divides remain over KOSA's "duty of care" standard, which critics argue could be weaponized by state attorneys general to censor politically contentious speech. Whether the Senate is willing to negotiate the duty of care language will likely determine if the package reaches the President's desk. As the technology outpaces the legislative process, the debate underscores the difficulty of regulating a probabilistic system: lawmakers are attempting to write deterministic rules for machines that are inherently unpredictable.[5]