WASHINGTON, D.C. — Today, the Electronic Privacy Information Center (EPIC) co-published *How Existing Laws Apply to AI Chatbots for Kids and Teens, *a reference guide that offers a practical overview of how regulators can use existing legal frameworks to address harms chatbots cause to minors. EPIC co-authored this guide with former federal enforcers Sam A.A. Levine, former Director of the FTC’s Bureau of Consumer Protection; Erie K. Meyer, former CFPB Chief Technologist; and Stephanie T. Nguyen, former FTC Chief Technologist.

“Companies shouldn’t get a free pass to ignore the law just because they call something ‘AI,’” said Kara Williams, Counsel at EPIC. “The same consumer protection and privacy laws that have existed for years also apply to chatbots, and enforcers can and should use these laws to address the harms that come from tech companies putting out dangerous technologies.”

Drawing from recent regulatory and enforcement actions by states and the FTC, the guide identifies key legal concepts and existing authorities enforcers can use, including:

• Restrictions on targeted ads and data selling or sharing involving minors under state privacy laws;

• Requirements on data collection, retention, and parental consent under the federal Children’s Online Privacy Protection Act (COPPA);

• The use of UDAP authorities by states or the FTC to challenge unfair or deceptive acts or practices around chatbot safety or capabilities; and

• State-level legislation governing AI mental health tools and “companion” chatbots.

“For years, federal policymakers let Big Tech police itself—allowing sweeping data collection with little oversight,” said Samuel A.A. Levine, Senior Fellow at the UC Berkeley Center for Consumer Law & Economic Justice. “With the same pattern now emerging around AI, states are once again leading the charge to safeguard privacy. This resource is designed to help them do just that.”

This resource outlines a privacy-forward approach to addressing chatbot harms that leverages existing state authority to curb common abuses of personal data. Regulators do not need to wait for legislators to pass chatbot-specific laws to take action against companies that make dangerous chatbots available to minors.

“We’re seeing tech companies turning to the same strategies now that they’ve used time and time again: premature launches, rapid deployment, public harm, and quiet rollbacks with no accountability,” said Stephanie Nguyen, Senior Fellow at the Vanderbilt Policy Accelerator and the Georgetown Institute for Technology Law & Policy. “This resource gives regulators a roadmap to stop this cycle in its tracks, using the laws already on the books.”

This guide may be updated to address other pressing chatbot-based harms, including the mishandling of sensitive personal data and deceptive or misleading chatbot interactions.

**### **

**ABOUT EPIC **

The Electronic Privacy Information Center (EPIC) was established in 1994 to protect privacy, freedom of expression, and democratic values in the information age. Our mission is to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation.

ABOUT GEORGETOWN INSTITUTE FOR TECHNOLOGY LAW & POLICY

The Georgetown Institute for Technology Law & Policy drives solutions at the nexus of law, policy, and technology—championing justice, inclusion, and accountability at this critical intersection.

**ABOUT VANDERBILT POLICY ACCELERATOR **

The Vanderbilt Policy Accelerator focuses on cutting-edge topics in political economy and regulation to swiftly bring research, education, and policy proposals from infancy to maturity.

**ABOUT UC BERKELEY CENTER FOR CONSUMER LAW & ECONOMIC JUSTICE **

The UC Berkeley Center for Consumer Law & Economic Justice, works to expand the reach of consumer protection laws and promote equity, fairness, and justice in the marketplace.