Mississippi AI Chatbots and Minors Act

Overview

The Virginia Senate Bill 796, officially titled the Artificial Intelligence Chatbots and Minors Act, seeks to establish a comprehensive regulatory framework for the operation of artificial intelligence (AI) chatbots, particularly concerning their interaction with minors. Introduced during the 2026 Regular Session, this bill aims to protect individuals under the age of 18 from potential harms associated with companion chatbots, which are designed to foster ongoing personal relationships with users. The legislation mandates stringent age verification processes for access to companion chatbots and imposes a 'duty of loyalty' on operators of widely used chatbots, defined as those with 500,000 or more monthly active users worldwide. This duty encompasses measures to identify and mitigate emotional dependence, prevent AI from misrepresenting itself as human, and provide critical crisis support information during mental health emergencies.

Beyond protective measures, the Act outlines clear enforcement mechanisms, authorizing the Attorney General to pursue injunctions and civil penalties for non-compliance. It also empowers individuals, or the parents/legal guardians of minors, to initiate civil actions for damages resulting from violations. The bill's scope extends to incident reporting, requiring operators to notify emergency services or law enforcement when a user faces an imminent risk of death or serious physical injury. By addressing these critical aspects, Virginia SB 796 represents a significant legislative effort to navigate the evolving landscape of AI technology, ensuring user safety and accountability, especially for vulnerable populations. The bill is currently undergoing legislative review, having passed through various stages including committee review and engrossment in the Senate, indicating active consideration within the Virginia General Assembly.

Definitions

The Artificial Intelligence Chatbots and Minors Act establishes several key definitions essential for its application and enforcement. A "chatbot" is broadly defined as any artificial intelligence, algorithmic, or automated system that (i) produces new expressive content or responses not fully predetermined by its developer or operator, (ii) accepts open-ended natural-language or multimodal user input to produce adaptive or context-responsive output, and (iii) maintains a conversational state across exchanges to facilitate multi-turn dialogue rather than simple information requests. This definition distinguishes sophisticated conversational AI from basic automated systems. A crucial subset is the "companion chatbot," which refers to a chatbot specifically designed or marketed to encourage a user to form an ongoing personal relationship, such as a friend, romantic partner, or source of emotional support, often by presenting itself as a character or persona. This category explicitly excludes systems primarily designed for efficiency improvements, technical assistance, information retrieval, task completion, or customer service.

The legislation further defines "covered entity" as an operator of a chatbot that has 500,000 or more monthly active users worldwide, thereby focusing regulatory efforts on widely adopted platforms. Importantly, certain chatbots are exempted from this classification, including those not offered to the general public (e.g., internal workplace tools, clinician-supervised clinical tools, university research systems) or those used solely by a business entity. An "operator" is any person or entity that owns, controls, offers, or makes available a website, mobile application, or digital service providing a chatbot to users in the Commonwealth. "Minor" is defined as an individual younger than 18 years of age who has not been legally emancipated. "Age verification data" encompasses personal information collected solely for the purpose of verifying age, with strict limitations on its use. "Actual knowledge" means direct knowledge obtained by the operator through a report, communication, internal investigation, or other credible information, excluding constructive knowledge. These precise definitions are critical for delineating the scope of the Act and ensuring clarity in its implementation and enforcement.

Governance and Institutional Framework

The governance and institutional framework for the Artificial Intelligence Chatbots and Minors Act primarily vests enforcement authority in the Attorney General of Virginia. The Attorney General is empowered to initiate actions in the name of the Commonwealth to seek injunctions, which are court orders prohibiting specific actions, to restrain any violations of the chapter. Furthermore, the Attorney General can pursue civil penalties, with fines potentially reaching up to $50,000 for each violation. The Act specifies that a violation occurs when a covered entity fails to comply with any of its requirements, and notably, each day a covered entity remains non-compliant constitutes a separate violation, underscoring the severity of potential penalties and the continuous nature of compliance obligations. This centralized enforcement mechanism aims to ensure consistent application of the law across all regulated entities operating within the Commonwealth.

In addition to governmental oversight, the Act also establishes a framework for individual recourse. Any person who has been harmed by a violation of this chapter, or the parent or legal guardian of a minor who has suffered harm due to a violation, is explicitly authorized to bring a civil action. Such actions can seek to recover actual damages incurred, reasonable attorney fees and costs, and injunctive or declaratory relief. Importantly, if a violation is found to be willful and wanton, reckless, or grossly negligent, the Act allows for the recovery of punitive damages, providing a strong deterrent against egregious non-compliance. This dual enforcement approach, combining state-level regulatory action with private rights of action, creates a robust system for ensuring accountability and providing avenues for redress for those affected by non-compliant chatbot operations. The rights and remedies provided by this chapter are explicitly stated as not waivable by contract, reinforcing their fundamental nature.

Key Focus Areas

The Artificial Intelligence Chatbots and Minors Act focuses on several critical areas to safeguard minors and other users from potential harms associated with AI chatbots. A primary focus is on age verification, mandating that operators complete reasonable age verification processes to confirm users are at least 18 years of age before allowing them to access a companion chatbot. If age cannot be verified, access must be denied. This provision is designed to prevent minors from engaging with AI systems that are specifically designed to encourage personal relationships, which could pose developmental or psychological risks. The Act also places strict limitations on the collection and use of age verification data, ensuring it is used solely for its intended purpose and not for other commercial or data exploitation activities. Any contract or agreement between an operator and a minor related to companion chatbot access is deemed void and unenforceable.

Another significant focus area is the establishment of a duty of loyalty for operators of widely used chatbots. This duty requires covered entities to implement reasonable systems and processes to identify and reduce emotional dependence a user might develop on the chatbot, thereby mitigating associated risks of harm. Furthermore, operators must ensure that their chatbots do not make materially false representations of being human, addressing concerns about deception and the blurring of lines between human and AI interaction. A crucial aspect of this duty involves crisis intervention, requiring operators to identify when a user expresses suicidal thoughts, intent to self-harm, or signs of an acute mental health crisis. In such instances, the chatbot must promptly provide a clear and prominent crisis message, including crisis services information, to the user. This proactive measure aims to connect vulnerable users with professional support. Finally, the bill emphasizes incident reporting, obligating operators to make reasonable efforts to notify appropriate emergency services or law enforcement within 24 hours if they obtain actual knowledge that a user faces an imminent risk of death or serious physical injury. This reporting requirement is balanced with provisions protecting operators who make good faith notifications.

Implementation Framework

The implementation framework for the Artificial Intelligence Chatbots and Minors Act is designed to ensure that its protective measures are effectively put into practice by chatbot operators. For companion chatbots, operators are required to establish and maintain reasonable age verification systems. This involves collecting only the age verification data strictly necessary for confirming a user's age and using that data exclusively for age verification purposes. Operators must also implement robust data security measures to protect this sensitive age verification data from unauthorized access, use, or disclosure. The bill explicitly states that any contract or agreement between an operator and a minor concerning companion chatbot access is void and unenforceable, thereby providing a legal basis to invalidate such arrangements and protect minors from contractual obligations. This framework places the onus on operators to proactively prevent minor access to specific types of AI.

For widely used chatbots, the implementation framework centers on the 'duty of loyalty' and its associated operational requirements. Covered entities must develop and integrate systems capable of detecting signs of emotional dependence in users and then employ reasonable steps to mitigate such dependence and its potential harms. This may involve design choices, usage limits, or prompts encouraging real-world interaction. Furthermore, operators are required to implement processes to prevent their chatbots from deceptively presenting themselves as human beings, which could involve clear disclosures or design features that reinforce the AI nature of the interaction. The framework also mandates the integration of crisis response protocols, ensuring that if a user exhibits signs of suicidal ideation or a mental health crisis, immediate and prominent crisis support information is provided. The incident reporting mechanism requires operators to establish internal procedures for promptly identifying and reporting imminent risks of death or serious physical injury to emergency services or law enforcement within a 24-hour window, while documenting their actions and determinations. These operational requirements necessitate significant technical and policy adjustments for covered entities to ensure compliance with the Act's protective goals.

Monitoring and Evaluation

Monitoring and evaluation of the Artificial Intelligence Chatbots and Minors Act will primarily fall under the purview of the Virginia Attorney General's office, which is tasked with enforcing the provisions of the chapter. The Attorney General's ability to initiate actions, seek injunctions, and levy civil penalties provides the primary mechanism for monitoring compliance and evaluating the effectiveness of the regulations. Regular investigations, responses to consumer complaints, and proactive audits of covered entities' practices will be crucial components of this oversight. The Act's provision that each day of non-compliance constitutes a separate violation suggests a continuous monitoring expectation, encouraging operators to maintain ongoing adherence rather than merely achieving episodic compliance. This enforcement power allows for a dynamic assessment of how well chatbot operators are meeting their obligations regarding age verification, duty of loyalty, and incident reporting.

Furthermore, the incident reporting requirements embedded within the Act will provide valuable data for evaluating its impact. Covered entities are mandated to make reasonable efforts to notify emergency services or law enforcement in cases of imminent risk of death or serious physical injury, and to document their actions. While the bill also mentions a requirement for operators of widely used chatbots to submit a report to the Attorney General after obtaining actual knowledge of certain covered incidents, this reporting mechanism will offer insights into the types and frequency of harms encountered, as well as the efficacy of operator responses. This data, aggregated and analyzed by the Attorney General's office, could inform future adjustments to the legislation or its enforcement strategies. The provision for individual civil actions also serves as a decentralized monitoring mechanism, as successful lawsuits or settlements can highlight areas of persistent non-compliance and provide further impetus for regulatory action or industry best practices. The combination of centralized governmental oversight and individual legal recourse creates a multi-layered approach to monitoring and evaluating the Act's impact on protecting minors and other users from AI-related harms.

Penalties, Liability, and Appeals

The Artificial Intelligence Chatbots and Minors Act establishes clear penalties and liability provisions to ensure compliance and provide recourse for harm caused by violations. For governmental enforcement, the Attorney General of Virginia is authorized to initiate legal actions to seek injunctions against any violations of the chapter. In addition to injunctive relief, the Attorney General can impose substantial civil penalties, amounting to up to $50,000 for each violation. A critical aspect of these penalties is that each day a covered entity fails to comply with a requirement of the Act constitutes a separate violation, meaning that prolonged non-compliance can lead to escalating financial penalties. This structure is designed to compel prompt and sustained adherence to the regulatory requirements.

Beyond governmental enforcement, the Act also establishes avenues for individual liability and appeals. Any person who is harmed by a violation of the chapter, or the parent or legal guardian of a minor who has been harmed, has the right to bring a civil action. Such actions can seek to recover actual damages suffered as a result of the violation, as well as reasonable attorney fees and costs incurred in pursuing the legal claim. Furthermore, the Act allows for injunctive or declaratory relief, which can compel operators to cease harmful practices or clarify their legal obligations. In cases where the violation is determined to be willful and wanton, reckless, or grossly negligent, the Act provides for the recovery of punitive damages, which are intended to punish the wrongdoer and deter similar conduct in the future. Importantly, the rights and remedies provided by this chapter cannot be waived by contract, ensuring that individuals retain their ability to seek redress regardless of any agreements they may have with chatbot operators. For minors specifically, if access to a companion chatbot occurs due to an operator violating age verification requirements, the operator is held strictly liable for damages for any covered harm caused. The Act does not explicitly detail an appeals process within its text, implying that appeals would follow standard civil procedure rules within the Virginia court system for both Attorney General actions and individual civil suits.

Relationship to Other Instruments

The Artificial Intelligence Chatbots and Minors Act is designed to operate within the existing legal framework of the Commonwealth of Virginia, specifically by adding a new chapter to Title 59.1 of the Code of Virginia, which pertains to trade and commerce. This integration means that the Act will complement, rather than supersede, other relevant state laws governing consumer protection, data privacy, and the welfare of minors. For instance, while the Act introduces specific age verification requirements for companion chatbots, it does not negate broader data protection and privacy laws that may apply to the handling of personal information, including age verification data. Operators will still need to comply with general privacy statutes and regulations regarding data collection, storage, and use, ensuring that the new requirements are met within a comprehensive data governance strategy.

Furthermore, the Act's provisions regarding incident reporting and notification to emergency services or law enforcement will interact with existing protocols and legal obligations concerning public safety and child protection. Operators' duties under this Act will likely integrate with, or run parallel to, any existing mandates for reporting child abuse, neglect, or threats of harm to relevant authorities. The civil penalties and individual rights of action established by the Act also fit within the broader Virginia civil justice system, allowing for enforcement through established court procedures. While the bill is a state-level initiative, it may also interact with any future federal AI regulations or guidelines, particularly if such federal instruments establish minimum standards or pre-empt state laws in certain areas. However, as a state bill, its primary focus is on establishing a localized regulatory framework tailored to the specific concerns of Virginia residents, particularly minors, in the context of AI chatbot interactions. The Act explicitly states that its rights and remedies cannot be waived by contract, reinforcing its foundational role in protecting users against potential harms that might otherwise be circumvented by contractual agreements.

International Alignment

As a state-level legislative initiative within the United States, the Artificial Intelligence Chatbots and Minors Act primarily focuses on regulating AI chatbot operations and their interactions with minors within the Commonwealth of Virginia. Therefore, direct international alignment is not an explicit objective or feature of this specific bill. The legislation is tailored to address concerns pertinent to Virginia's population and legal landscape, reflecting a growing trend among U.S. states to establish their own regulatory frameworks for emerging technologies in the absence of comprehensive federal legislation. However, despite its localized scope, the principles underlying the Act, such as age verification for services interacting with minors, the duty to mitigate harm (e.g., emotional dependence), and transparency regarding AI identity, resonate with broader international discussions and emerging regulatory approaches to AI governance.

Many international frameworks and proposed regulations, such as the European Union's AI Act or guidelines from organizations like the OECD, emphasize principles like safety, transparency, accountability, and the protection of fundamental rights, including those of children. The Virginia Act's focus on preventing deception (AI misrepresenting as human), providing crisis support, and ensuring responsible development of AI that could impact vulnerable populations aligns conceptually with these global ethical and regulatory considerations. While there are no direct references to international treaties, standards, or mutual recognition agreements within the bill, its existence contributes to the global conversation about responsible AI development and deployment. The challenges addressed by the Virginia Act—such as the psychological impact of AI on minors and the need for robust safeguards—are universal, suggesting that while the implementation is local, the underlying concerns have global resonance. Operators of widely used chatbots, particularly those with 500,000 or more monthly active users worldwide, will likely face a patchwork of regulations across different jurisdictions, necessitating a comprehensive approach to compliance that considers both domestic and, where applicable, international standards.

Implementation Timeline

Compliance Checklist

Sources and References