After an earlier Senate push focused on restricting children’s access to AI companion tools, the CHATBOT Act raises a more practical question for vendors: which parental-control, consent, memory, and advertising systems would they need to build if Congress moves forward?
The Children’s Health, Advancement, Trust, Boundaries, and Oversight in Technology Act, or CHATBOT Act, was introduced April 28, 2026, by Sens. Ted Cruz, Brian Schatz, John Curtis, and Adam Schiff. The bill is not law, but it gives AI providers, school-facing vendors, and enterprise buyers a view of the platform controls lawmakers may expect around minors’ chatbot access.
Parental controls move into chatbot design
The proposal is part of a broader congressional push on child chatbot safety, including a separate Senate bill that advanced from committee in a 22-0 vote to restrict AI chatbots for children.
The Senate Commerce Committee described the CHATBOT Act as applying to public-facing AI chatbots that can hold open-ended conversations with users. The proposal excludes narrow-purpose systems used mainly for customer service, internal research, technical assistance, or training.
Under the bill text, a provider that knows a user is a child under 13 would have to require access through a family account. If the provider knows a user is a teen, it would have to notify a parent and obtain verifiable parental consent before account creation.
Family accounts would let parents limit use time, disable rewards or badges, turn off notifications and push alerts, block financial transactions, restrict unsolicited outputs, set AI transparency labels, limit chatbot memory, and receive a full record of the minor’s conversations and activity.
The advertising rule is not a blanket ad ban. Covered entities could not use personal data from known child or teen users for targeted advertising, but the bill would still allow some age-appropriate advertising that does not use personal information beyond age.
Violations would be treated as unfair or deceptive acts under the Federal Trade Commission Act, and state attorneys general could bring civil actions.
The problem with self-reported age
The bill does not require age gating, age verification, government ID checks, or new age-data collection. Its strongest obligations instead depend on whether a provider knows, or whether objective circumstances fairly imply, that a user is a child or teen.
That standard creates compliance questions for AI products that depend on self-reported age, especially as governments weigh stricter limits on AI tools in schools. Vendors may need clearer documentation showing how their systems detect age signals, record consent status, manage chatbot memory, restrict ad targeting, escalate complaints, and safeguard user data.
The FTC is already examining the market. In September 2025, the agency opened a 6(b) study of AI companion chatbots, seeking information on safety testing, age restrictions, minors’ access to companion features, and use of personal information.
That scrutiny follows broader concerns over how companies test chatbots against high-risk teen prompts before those systems reach young users. Recent concerns over employee activity data collected for AI training show how AI inputs, telemetry, and user records can become enterprise risk beyond youth-facing products.
The next signal is whether the Senate Commerce Committee schedules action on the CHATBOT Act. Until then, the bill remains a proposal, but it shows the platform controls lawmakers are considering around minors’ chatbot access, memory, advertising, and parental oversight.
Read more: Related AI governance risks are also emerging in developer environments, where agentic tools can read files, run commands, and act on untrusted project content in AI coding workflows.