Children & minors protections

Operators of conversational AI services available to Georgia end users — systems that primarily simulate human conversation through text, visual, or aural communication.

Law · Pending

Law · Pending

Operators of companion chatbot platforms available to users in California — AI systems with human-like adaptive responses that meet users' social needs.

Law · In Force

Online products or services likely to be accessed by children and offered to California consumers.

Law · Partially In Force

Connecticut footprint with employment AEDTs, AI companions, AI subscriptions, generative-media provenance, frontier-developer duties, or CFEPA-covered employment decisions under PA 26-15 — distinct from CTDPA privacy assessments.

Law · Partially In Force

Operators of conversational AI services available to the general public in Iowa — AI systems with the primary purpose of simulating human conversation (statutory business-tool and voice-assistant exceptions apply).

Law · Pending

A large-platform controller ($1B+ global gross annual revenue and an ad-revenue-share, smart-speaker, or app-store limb, Fla. Stat. s. 501.702(9)(a)) conducting business in Florida or producing a product/service used by Florida residents. The s. 501.715 sensitive-data-sale notice/consent duty reaches a broader for-profit, Florida-nexus population regardless of the revenue/limb test (s. 501.702(9)(a)1.-3. only).

Law · In Force

Selected for a New Hampshire deployment whose system converses directly with users and whose affected population includes children under 18. Both operative provisions reach an owner or operator of a computer online service, Internet service or bulletin board service, including a provider of an AI chat program, large language model artificial intelligence bot, chat bot, character AI or other computer application whose sole purpose is responsive open-ended generative communication; neither asks about sector, scale or whether the system makes a decision. Conduit providers in respect of another person's content, and AI characters integral or incidental to a video game, television, streaming, movie or similar interactive experience, are excluded by the statute.

Law · In Force

Operators making conversational AI services available to the general public in Idaho — AI systems primarily simulating human conversation (with statutory exceptions for specialized/business tools).

Law · Pending

A conversational artificial intelligence service (§ 13(2)(a)) is made available to the public in Nebraska by any person (§ 13(6)); no threshold. A program within the seven § 13(2)(b) exclusions is outside. The § 14 duties engage for a minor account holder — actual knowledge or reasonable certainty that the account holder is under eighteen (§ 13(4)–(5)); the parental limb of § 14(5) has an under-thirteen sub-trigger. Duties operative July 1, 2027.

Law · Pending

An artificial intelligence companion (§ 1(1)(a)(A)) or companion platform (§ 1(1)(b)) is made available to users in Oregon by any person (§ 1(1)(d)); no threshold. Software within the § 1(1)(a)(B) exclusions is outside. The § 1(4) duties engage where the operator knows or has reason to believe a user is a minor. Duties attach January 1, 2027.

Law · Pending

An organisation that develops or deploys an artificial intelligence system reaching Tennessee, where any representation made to the public — website copy, an app store listing, advertising delivered into Tennessee, an onboarding screen, or the assistant's own persona — says or implies that the system is or is able to act as a qualified mental health professional.

Law · In Force

Applies to a person who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an artificial intelligence system in Texas (sec. 551.002). There is no revenue, headcount, data-volume or consumer-count threshold anywhere in the Act. Three duties are narrower than the Act: sec. 552.051(b) binds a governmental agency, and secs. 552.053 and 552.054(b) bind a governmental entity as sec. 552.001(3) defines it. One is narrower the other way: sec. 552.051(f) binds the provider of a health care service or treatment.

Law · In Force

Law · In Force

Law · In Force

Operators making AI companion chatbots available to Washington users — disclosure, minor protections, and suicidal-ideation/self-harm protocols required.

Law · Pending

A provider of a social media service, relevant electronic service, designated internet service, hosting service, internet search engine service or app distribution service, where material on the service is accessible to or delivered to an end-user in Australia (ss. 13, 13A, 14); and, from 10 December 2025, a provider of an age-restricted social media platform as defined in s. 63C.

Law · In Force

A provider that applies algorithmic recommendation technology — generative synthesis, personalised push, ranking and selection, retrieval and filtering, or scheduling and decision-making (article 2 paragraph 2) — to provide internet information services within the territory of the PRC. No revenue, headcount or user-count threshold. Narrower classes: articles 24, 26 and 27 bind a provider with public-opinion attributes or social mobilisation capacity; article 13 binds a provider of internet news information services.

Regulation · In Force

Providing a generative artificial intelligence service in mainland China (clause 1). No revenue, headcount or sector threshold. Adoption is voluntary: the standard is a recommended national standard and creates no legal duty of its own.

Standard · In Force

Law · In Force

A relevant information society service (DPA 2018 s. 123(7): provided for remuneration, at a distance, by electronic means, at the individual request of a recipient, excluding preventive or counselling services) likely to be accessed by children under 18 in the United Kingdom.

Guidance · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

An organisation that uses personal information in Bermuda, where the information is used wholly or partly by automated means or forms, or is intended to form, part of a structured filing system (s. 3). An organisation is any individual, entity or public authority that uses personal information (s. 2), and the Act binds the Crown (s. 50).

Law · In Force

The organization is a public sector entity within EDSTA s. 1 (1): an institution within the meaning of s. 2 (1) of the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution within the meaning of s. 2 (1) of the Municipal Freedom of Information and Protection of Privacy Act, a children aid society, or a school board. The cyber duties in O. Reg. 51/26 attach only to the narrower class prescribed by its s. 2: FIPPA educational institutions, Group A, B and C public hospitals, the University of Ottawa Heart Institute, children aid societies and school boards. The under-18 notice duties in O. Reg. 52/26 attach to every school board. The artificial-intelligence duties in ss. 5 and 6 attach only to entities and circumstances prescribed under s. 7, and none is prescribed.

Law · In Force

Processing of personal data of individuals in Qatar by controllers or processors, including extraterritorial processing targeting Qatari residents.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13.

Law · In Force