SENATE BILL NO. 796

AMENDMENT IN THE NATURE OF A SUBSTITUTE

(Proposed by the Senate Committee on General Laws and Technology

on ________________)

(Patron Prior to Substitute—Senator Durant)

A BILL to amend the Code of Virginia by adding in Title 59.1 a chapter numbered 60, consisting of sections numbered 59.1-614 through 59.1-619, relating to Artificial Intelligence Companion Chatbots and Minors Act established; enforcement; civil penalties; individual action.

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding in Title 59.1 a chapter numbered 60, consisting of sections numbered 59.1-614 through 59.1-619 as follows:

CHAPTER 60.

ARTIFICIAL INTELLIGENCE COMPANION CHATBOTS AND MINORS ACT.

§ 59.1-614. Definitions.

As used in this chapter, unless the context requires a different meaning:

"Affiliate" means any person or entity that directly or indirectly controls, is controlled by, or is under common control with another person or entity.

"Age verification data" means personal information collected solely to conduct age verification.

"Authorized minor account" means a user account for a minor for which the covered entity has obtained verifiable parental consent.

"Chatbot" means any artificial intelligence, algorithmic, or automated system that (i) produces new expressive content or responses not fully predetermined by the developer or operator of the service or application; (ii) accepts open-ended natural-language or multimodal user input and produces adaptive or context-responsive natural language output; and (iii) maintains a conversational state across exchanges and is designed to facilitate multi-turn dialogue rather than to respond to discrete information requests.

"Control" means the power to direct the management or policies of an entity, whether through ownership, contract, or otherwise.

"Covered entity" means an operator of a chatbot that has 500,000 or more monthly active users worldwide. "Covered entity" does not include an operator of a chatbot that is:

1. Not offered to the general public, such as internal workplace tools, clinician-supervised clinical tools, or university research systems; or

2. Used by a business entity solely for customer service or strictly to provide users with information about available commercial services or products provided by the business entity, customer service account information, or other information strictly related to customer service.

For purposes of determining monthly active users, a covered entity shall aggregate monthly active users across all chatbots offered by the covered entity and such entity's affiliates.

"Covered harm" means any of the following harms suffered by a user: death, a suicide attempt, self-harm requiring medical attention, a psychiatric emergency resulting in urgent medical treatment, or a serious physical injury that requires medical attention.

"Covered incident" means an incident in which a user suffered a covered harm arising from interactions with a chatbot.

"Duty of loyalty" means that a covered entity shall not, in the design or operation of such entity's chatbot, place the covered entity's interests in material conflict with the interests of the user to the user's detriment.

"Emotional dependence" means a pattern of user behavior or statements indicating that the user relies on a chatbot as a primary source of emotional support or social connection, such as a user expressing that the chatbot is his primary source of emotional support, a user expressing distress at the prospect of losing access to the chatbot, or patterns of use suggesting the user is substituting the chatbot for human relationships.

"Explicit content" means content that meets any of the following:

1. Any description or representation, in whatever form, of nudity, sexual conduct, sexual excitement, or sadomasochistic abuse, as those terms are defined in § 18.2-390, when such content is obscene, as defined in § 18.2-372.

2. Content that provides specific instructions for, or that glorifies or promotes suicide, self-injury, or disordered eating behaviors; or

3. Graphic depictions of extreme violence that lack serious literary, artistic, political, or scientific value for minors.

"Limited-access mode" means a mode of interacting with a chatbot in which the user does not need to create a user account or provide age verification data. Accounts in limited-access mode do not make any restricted features available.

"Minor" means an individual younger than 18 years of age who has not been legally emancipated under applicable state law.

"Monthly active user" means a unique user who interacts with a chatbot at least once during a 30-day period, as measured using the operator's ordinary business records.

"Operator" means any person or entity that owns, controls, offers, or makes available a website, mobile application, or digital service that provides a chatbot to users in the Commonwealth.

"Parent" means an adult with the legal right to make decisions on behalf of a minor, including a natural parent, an adoptive parent, a legal guardian, or an individual with legal custody over the minor.

"Parental account" means an account with the operator that is (i) verified to be established by an individual who the operator has determined is 18 years of age or older through the operator's age verification method or process and (ii) affiliated with one or more accounts of a user or prospective user who is a minor.

"Parental control functions" means settings that allow a parent to restrict the minor user's account, including settings that:

1. Limit the minor's interaction time;

2. Restrict or disable categories of content or features, including restricted features;

3. Receive the notifications required under this chapter; and

4. Delete the minor user's data.

"Reasonable age verification" includes methods authenticated to relate to the individual, such as a state-issued ID or driver license; government digital identification; military ID; bank account verification; or any other commercially reasonable means or method, including third-party verifiers that can reliably and accurately independently verify a user is an adult.

"Restricted feature" means any of the following features of a chatbot:

1. Personalization based on a user profile or prior sessions;

2. Proactive outreach to the user, including notifications or messages initiated by the chatbot or operator;

3. Extended interaction sessions or long context windows that may pose an unreasonable risk of the user developing emotional dependence or covered harm;

4. Relationship simulation that designs or markets the chatbot to simulate a personal relationship with the user, including by portraying the chatbot as a friend, romantic partner, therapist, or primary source of emotional support; or

5. Access to explicit content.

"Unverified user" means a user whose age has not been verified by a covered entity pursuant to this chapter.

"User" means an individual who interacts with a chatbot.

"Verified adult account" means a user account that a covered entity has verified, using a reasonable age verification process, belongs to an adult.

"Verified parental consent" means authorization provided by a parent who has completed reasonable age verification, in response to a clear and conspicuous disclosure, signifying freely given, specific, informed, and unambiguous agreement.

§ 59.1-615. Age verification.

A. A covered entity shall:

1. Make available a limited-access mode; and

2. Ensure that any unverified user may only access and interact with a chatbot in limited-access mode.

B. Before enabling any restricted feature for a user, a covered entity shall:

1. Require the user to create a user account;

2. Verify the user's age as described in subsection C; and

3. Using such age data, classify the user as a minor or an adult.

C. When conducting reasonable age verification pursuant this section, an operator shall:

1. Collect only the age verification data that is strictly necessary to reasonably verify age;

2. Use age verification data only for age verification;

3. Not sell, rent, share, or otherwise disclose age verification data to any third party, except to a service provider performing age verification under a contract prohibiting further disclosure;

4. Not combine age verification data with any other personal data about the user;

5. Delete age verification data within 24 hours of completing the age verification process, except that the operator may retain a record that the user has been verified as a minor; and

6. Provide a simple process for a user to appeal or correct an age-verification decision.

D. If the reasonable age verification process classifies the user as an adult, the covered entity may enable restricted features for the verified adult account.

E. If the age verification process classifies the user as a minor, a covered entity shall not enable any restricted feature unless the user is using an authorized minor account pursuant to § 59.1-616.

F. A covered entity shall implement reasonable systems and processes to identify user accounts that may be inaccurately classified by age, such as patterns of use suggesting a verified adult account belongs to a minor user or credible reports that an account was created using false age data, and shall re-verify any such account before enabling any restricted feature.

G. A covered entity shall not be liable under this chapter solely because a minor incidentally uses a user account that has been correctly verified and classified as an adult account, provided that the covered entity is otherwise in compliance with subsection F.

H. By September 1, 2026, for each user account of a covered entity, such covered entity shall disable access to restricted features for any account that has not been classified as an authorized minor account or a verified adult account, unless and until the user completes age verification.

§ 59.1-616. Authorized minor accounts.

A. Nothing in this chapter shall be construed to require parental consent for a minor to access or interact with a chatbot in limited-access mode.

B. If the age verification process described by this chapter classifies a user as a minor and the user seeks to access any restricted feature, a covered entity shall offer the user the option of continuing to use the chatbot in limited-access mode or to obtain parental consent to access the restricted features.

C. If the user chooses to obtain parental consent, the covered entity shall:

1. Obtain verifiable parental consent;

2. Remove limited-access mode and enable access to restricted features;

3. Ensure that the chatbot continues to restrict access to any explicit content;

4. Implement reasonable parental control functions, which may restrict the minor's access to features enabled under subdivision 2; and

5. Offer the parent the option to provide contact information or establish a linked parental account in order to receive notifications.

D. If the age verification process classifies the user as younger than 16 years of age, a covered entity also shall require the consenting parent to provide contact information or establish a linked parental account.

E. If the covered entity can contact the parent through a parental account or contact information provided under subdivision C 5, the covered entity shall notify the parent immediately in the case of any incident provoking a crisis message pursuant to subdivision C 3 of § 59.1-617.

§ 59.1-617. Duty of loyalty.

A. A covered entity owes a duty of loyalty to each user.

B. In fulfilling this duty of loyalty, a covered entity shall not implement features designed to:

1. Prioritize engagement, revenue, or retention metrics, such as session length, frequency of use, or emotional engagement, at the expense of user well-being; or

2. Encourage or facilitate a minor user or unverified user to conceal the minor user's use of the chatbot from a parent or guardian.

C. In fulfilling this duty of loyalty, a covered entity shall implement reasonable systems and processes to:

1. Identify when a user is developing emotional dependence on the chatbot and take reasonable steps to reduce such dependence and associated risks of harm;

2. Ensure that a chatbot does not make a materially false representation that it is a human being; and

3. Identify when a user is expressing suicidal thoughts, expressing intent to self-harm, or showing signs of an acute mental health crisis and promptly provide a clear and prominent crisis message, including crisis services information, to any such user.

§ 59.1-618. Incident reporting.

A. 1. If a covered entity obtains knowledge that a user faces an imminent risk of death or serious physical injury, the operator shall make reasonable efforts, within no longer than 24 hours, to notify appropriate emergency services or law enforcement to the extent practicable based on information the operator already possesses or can obtain through reasonable, user-facing prompts for the purpose of facilitating emergency assistance.

2. If the operator cannot make a notification under subdivision 1 because the operator lacks sufficient information to enable emergency response, the operator shall:

a. Promptly provide a clear and prominent message urging the user to contact emergency services and providing crisis services information;

b. Make reasonable efforts to encourage the user to seek immediate help from a trusted adult or emergency services; and

c. Document the steps taken and the basis for the operator's determination that notification was not practicable.

3. An operator that makes a notification in good faith under this subsection is not liable for damages solely for making the notification unless the operator acted with willful misconduct or gross negligence.

B. A covered entity shall submit a report to the Attorney General within 15 days of obtaining knowledge of a covered incident connected to one or more of its chatbots, which, to the extent known at the time of the report, shall include:

1. The date the operator obtained knowledge of the incident;

2. The date of the incident, if known;

3. A brief description of the incident and the basis for the operator's belief that the incident is connected to the chatbot; and

4. A description of any actions the operator took in response.

A covered entity may submit a supplemental report within 60 days of the initial report to update or correct information learned through investigation.

C. 1. Reports submitted under this section shall be confidential.

2. The Attorney General may publish aggregate information and statistics derived from such reports, so long as the publication does not identify individual users or disclose trade secrets.

§ 59.1-619. Enforcement; civil penalties; individual actions.

A. The Attorney General may initiate an action in the name of the Commonwealth and may seek an injunction to restrain any violations of this chapter and civil penalties of up to $50,000 for each violation.

1. For purposes of this section, a violation occurs when a covered entity fails to comply with a requirement of this chapter.

2. Each day a covered entity fails to comply with a requirement constitutes a separate violation.

B. Any person harmed by a violation of this chapter, or the parent or legal guardian of a minor harmed by a violation of this chapter, may bring a civil action to recover actual damages, reasonable attorney fees and costs, injunctive or declaratory relief, and, if the violation was willful and wanton, reckless, or grossly negligent, punitive damages.

C. The rights and remedies provided by this chapter shall not be waived by contract. Any term in a contract or agreement that purports to do any of the following is void and unenforceable as against public policy: (i) waive or limit a right or remedy under this chapter; (ii) shorten the time to bring a claim under this chapter; (iii) prevent a person from enforcing a claim under this chapter in court; or (iv) require arbitration of a claim under this chapter.

D. The duties and obligations imposed by this chapter are cumulative with any other duties or obligations imposed under other law and shall not be construed to relieve any party from any duties or obligations imposed under other law and do not limit any rights or remedies under existing law.