Chatbots

Chatbots are being deployed in many contexts despite widespread documented harms, including mental health issues, financial harm, medical harm, emotional dependence, manipulation and deception, psychosis, delusional thinking, self-harm and suicide, bias reinforcement, and anger or impulsive actions.

The People-First Chatbot bill

In early 2026, EPIC, the Consumer Federation of America (CFA), and Fairplay released the People-First Model Chatbot Bill, a comprehensive, common-sense framework to protect individuals as chatbots become increasingly embedded into everyday life. More than 70 organizations have endorsed the model.

The People-First Model Chatbot Bill centers around a simple truth: Chatbots are products, not people. They’re created and released by companies that must be held accountable when their products harm people, just like a charger that starts a fire, or faulty airbags that fail to deploy in a car crash.

In addition to setting clear liability standards for instances when people are injured through chatbots’ use, the model prevents companies from exploiting chatbot interactions for targeted advertising, limits the use of personal data and chat content to profile users, and requires safeguards to ensure chatbots do not falsely present themselves as capable of providing qualified medical, legal, or financial advice. The bill also includes strong protections for children by banning companies from using minors’ input data to train chatbots and prohibiting the use of people’s input data for training without their knowledge or consent, requiring affirmative consent from adults over 18. Together, these provisions draw bright lines that protect consumers while providing certainty for responsible innovation.

The legislation has already been introduced in several states. CFA, EPIC, and Fairplay are calling on statehouses nationwide to introduce and advance this legally sound, people-first model to protect consumers, uphold accountability, and set consistent standards for chatbot deployment across the country.

Existing Laws can be applied to AI Chatbots

In late 2025, EPIC co-published How Existing Laws Apply to AI Chatbots for Kids and Teens, a reference guide that offers a practical overview of how regulators can use existing legal frameworks to address harms chatbots cause to minors. EPIC co-authored this guide with former federal enforcers Sam A.A. Levine, former Director of the FTC’s Bureau of Consumer Protection; Erie K. Meyer, former CFPB Chief Technologist; and Stephanie T. Nguyen, former FTC Chief Technologist.

This resource outlines a privacy-forward approach to addressing chatbot harms that leverages existing state authority to curb common abuses of personal data. Regulators do not need to wait for legislators to pass chatbot-specific laws to take action against companies that make dangerous chatbots available to minors. 

Drawing from recent regulatory and enforcement actions by states and the FTC, the guide identifies key legal concepts and existing authorities enforcers can use, including: 

• Restrictions on targeted ads and data selling or sharing involving minors under state privacy laws; 
• Requirements on data collection, retention, and parental consent under the federal Children’s Online Privacy Protection Act (COPPA); 
• The use of UDAP authorities by states or the FTC to challenge unfair or deceptive acts or practices around chatbot safety or capabilities; and 
• State-level legislation governing AI mental health tools and “companion” chatbots.