S 896 — Chatbot Regulation

       (13) "Limited-access mode" means a mode of interacting with a chatbot in which the user does not need to create a user account or provide age verification data.

Accounts in limited-access mode do not make any of the restricted features available.

       (14) "Minor" means an individual under eighteen years of age.

       (15) "Monthly active user" means a unique user who interacts with a chatbot at least once during a thirty-day period, as measured using the covered entity's ordinary business records.

       (16) "Operator" means any person or entity that owns, controls, offers, or makes available a website, mobile application, or digital service that provides a chatbot to users in this State.

       (17) "Reasonable age verification" includes methods authenticated to relate to the individual, such as a state-issued identification or driver's license;

government digital identification;

military identification;

bank account verification;

or any other commercially reasonable means or methods, including third-party verifiers that can reliably and accurately independently verify a user is an adult.

       (18) "Restricted feature" means:

           (a) personalization based on a user profile or prior sessions;

           (b) proactive outreach to the user, including notifications or messages initiated by the chatbot or covered entity;

           (c) extended interaction sessions or long context windows that may pose an unreasonable risk of the user developing emotional dependence or covered harm;

           (d) relationship simulation, meaning designing or marketing the chatbot to simulate a personal relationship with the user, including portraying the chatbot as a friend, romantic partner, therapist, or primary source of emotional support;

or            (e) access to explicit content.

       (19) "Parental account" means an account with the covered entity that is:

           (a) verified to be established by an individual who the covered entity has determined is at least eighteen years of age through the covered entity's age verification method or process;

and            (b) affiliated with one or more accounts of a user or prospective user who is a minor.

       (20) "Parental control functions" means settings that allow a parent to restrict the minor user's account including, but not limited to:

           (a) limiting the minor's interaction time;

           (b) restricting or disabling categories of content or features including, but not limited to, restricted features;

           (c) receiving the notifications required under this act;

and            (d) deleting the minor user's data.

       (21) "Personal data" means information that is linked or is reasonably linkable, either by itself or in combination with other information, to an identified or identifiable user.

Personal data does not include de-identified data or publicly available information.

       (22)(a) "Publicly available information" means information that has been lawfully made available to the public subject to a public records request.

           (b) "Publicly available information" does not include:

               (i) obscene items;

               (ii) biometric data;

               (iii) personal data that is created through the combination of personal data and publicly available information;

               (iv) genetic data, unless the genetic data was made available to the public by the user to whom the genetic data pertains;

               (v) information that is made available to the public by a user who uses a website or online platform on which the user has restricted the information to a specific audience;

or                (vi) intimate images that are either authentic or computer generated and that are known to be nonconsensual.

       (23) "Sell" means to exchange personal data or a chat log for monetary or other valuable consideration, or to make personal data or a chat log available to a third party for monetary or other valuable consideration.

"Sell" does not include disclosure of personal data or a chat log to a service provider that processes the data on behalf of the covered entity under a written contract prohibiting further disclosure.

       (24) "Unverified user" means a user whose age has not been verified by the covered entity pursuant to Section 39-81-20.

       (25) "User" means an individual who interacts with a chatbot.

       (26) "Verifiable parental consent" means authorization provided by a parent who has completed reasonable age verification in response to a clear and conspicuous disclosure signifying freely given, specific, informed, and unambiguous agreement.

       (27) "Verified adult account" means a user account that a covered entity has verified, using a reasonable age verification process, to belong to an adult.

      Section 39-81-20.  (A) A covered entity shall make a limited-access mode available and shall ensure that any unverified user may only access and interact with a chatbot in limited-access mode.

    (B) Before enabling any restricted feature for a user, a covered entity shall:

       (1) require the user to create a user account;

       (2) verify the user's age using a reasonable age-verification process, subject to item (3);

and        (3) using the age data, classify the user as a minor or an adult.

    (C) When conducting a reasonable age verification process under this section, a covered entity shall:

       (1) collect only the age-verification data that is strictly necessary to reasonably verify age;

       (2) use age verification data only for age verification;

       (3) not sell, rent, share, or otherwise disclose age-verification data to any third party, except to a service provider performing age-verification under a contract prohibiting further disclosure;

       (4) not combine age-verification data with any other personal data about the user;

       (5) delete age verification data within twenty-four hours of completing the age verification process, except that the covered entity may retain a record that the user has been verified as a minor;

and        (6) provide a simple process for a user to appeal or correct an age-verification decision.

    (D) If the reasonable age-verification process classifies the user as an adult, then the covered entity may enable restricted features for the verified adult account.

    (E) If the age-verification process classifies the user as a minor, then a covered entity shall not enable any restricted feature unless the user is using an authorized minor account subject to Section 39-81-30.

    (F) A covered entity shall implement reasonable systems and processes to identify user accounts that may be inaccurately classified by age, such as patterns of use suggesting a minor is using an adult account or credible reports that an account was created using false age data and shall reverify any such account before enabling any restricted feature.

    (G) A covered entity shall not be liable under this chapter solely because a minor incidentally uses a user account that has been correctly verified and classified as an adult account, provided the covered entity is otherwise in compliance with subsection (F).

    (H) With respect to each user account of a covered entity that exists as of the effective date of this act, a covered entity shall, within sixty days, disable access to restricted features for any account that has not been classified as an authorized minor account or a verified adult account, unless and until the user completes age verification.

      Section 39-81-30.  (A) Nothing in this act shall be construed to require parental consent for a minor to access or interact with a chatbot in limited-access mode.

    (B) If the age-verification process pursuant to Section 39-81-20 classifies a user as a minor and the user seeks to access any restricted feature, then a covered entity shall offer the user the option of continuing to use the chatbot in limited-access mode or to obtain parental consent to access the restricted features.

    (C) If the user chooses to get parental consent, then the covered entity shall:

       (1) obtain verifiable parental consent;

       (2) remove limited-access mode and enable access to restricted features;

       (3) ensure that the chatbot continues to restrict access to any explicit content;

       (4) implement reasonable parental control functions, which may restrict the minor's access to features enabled under item (2);

       (5) offer the parent the option to provide contact information or establish a linked parental account in order to receive notifications;

and        (6) offer the parent the option to receive access to, and download in a portable and easy-to-read format, chat logs of any interactions between the minor and the chatbot conducted through the authorized minor account.

    (D) If the age-verification process classifies the user as under sixteen, then a covered entity also shall require the consenting parent to provide contact information or establish a linked parental account.

    (E) If the covered entity has a way to reach the parent through a parental account or contact information provided under subsection (C) or (D), then the covered entity shall notify the parent immediately in the case of any incident provoking a crisis message, pursuant to Section 39-81-40(B)(3), and when the covered entity first identifies that the minor is developing emotional dependence on the chatbot and takes steps pursuant to Section 39-81-40(B)(1) in response.

    (F) A covered entity shall not process the chat log or personal data of an authorized minor account to determine whether to display an advertisement to the minor, to determine a product or service to advertise to the minor, or to customize an advertisement for presentation to the minor.

    (G) A covered entity shall not process the chat log or personal data of an authorized minor account, including for purposes of training a model.

    (H) Notwithstanding subsections (F) and (G), a covered entity may process the chat log and personal data of an authorized minor account, and may train, fine tune, or evaluate models or classifiers using such data, to the extent strictly necessary to:

       (1) perform the duties required by Section 39-81-40 or 39-81-50;

       (2) test for, identify, or address a risk of harm to minors;

or        (3) comply with this chapter or other applicable law.

      Section 39-81-40.  (A) A covered entity shall not implement features designed to:

       (1) prioritize engagement, revenue, or retention metrics, such as session length, frequency of use, or emotional engagement, at the expense of user well-being;

or        (2) encourage or facilitate a minor user or unverified user concealing the user's use of the chatbot from a parent or guardian.

    (B) A covered entity shall implement reasonable systems and processes to:

       (1) identify when a user is developing emotional dependence on the chatbot and take reasonable steps to reduce that dependence and associated risks of harm;

       (2) ensure that a chatbot does not make a materially false representation that it is a human being;

and        (3) identify when a user is expressing suicidal thoughts, intent to self-harm, or showing signs of an acute mental health crisis and promptly shall provide a clear and prominent crisis message, including crisis services information to any such user.

    (C) A covered entity shall not:

       (1) represent in the advertising, interface, or output data of a chatbot that the chatbot is, or is licensed or certified as, any of the following:

           (a) a licensed legal professional;

           (b) a licensed medical professional;

           (c) a certified public accountant;

           (d) a licensed investment advisor or investment advisor representative;

           (e) a licensed fiduciary;

or            (f) any other certified, registered, or licensed professional;

       (2) represent in the advertising, interface, or output data of a chatbot that the user's chat log or personal data is confidential;

       (3) sell a user's chat log;

or        (4) retain a user's chat log for more than ten years, unless retention is required to comply with this chapter or otherwise required by law.

    (D) A covered entity shall:

       (1) develop, implement, and maintain a written comprehensive data security program that contains administrative, technical, and physical safeguards proportionate to the volume and nature of personal data and chat logs that the covered entity maintains, and make the program publicly available on its website;

and        (2) take reasonable physical, administrative, and technical measures to prevent de-identified data from being re-identified, and process, retain, and transfer de-identified data without any reasonable means of re-identification.

      Section 39-81-50.  (A)(1) If a covered entity obtains knowledge that a user faces an imminent risk of death or serious physical injury, then the covered entity must make reasonable efforts, within twenty-four hours, to notify appropriate emergency services or law enforcement, to the extent practicable based on information the covered entity already possesses or can obtain through reasonable, user-facing prompts for the purpose of facilitating emergency assistance.

       (2) If the covered entity cannot make a notification under item (1) because the covered entity lacks sufficient information to enable an emergency response, then the covered entity shall:

           (a) promptly provide a clear and prominent message urging the user to contact emergency services and provide crisis services information,            (b) make reasonable efforts to encourage the user to seek immediate help from a trusted adult or emergency services;

and            (c) document the steps taken and the basis for the covered entity's determination that notification was not practicable.

       (3) A covered entity that makes a notification in good faith under this subsection is not liable for damages solely for making the notification, unless the covered entity acted with wilful misconduct or gross negligence.

       (4) If the user for whom a notification is made under item (1) is a minor using an authorized minor account, the covered entity also immediately shall notify the parent through any parental account or contact information on file.

    (B)(1) A covered entity shall submit a report to the Attorney General within fifteen days of obtaining knowledge of a covered incident connected to one or more of its chatbots, which, to the extent known at the time of the report, shall include:

           (a) the date the covered entity obtained knowledge of the incident;

           (b) the date of the incident, if known;

           (c) a brief description of the incident and the basis for the covered entity's belief that the incident is connected to the chatbot;

and            (d) a description of any actions the covered entity took in response.

       (2) A covered entity may submit a supplemental report within sixty days after the initial report to update or correct information learned through investigation.

    (C)(1) Reports submitted under this section shall be confidential and are not subject to disclosure pursuant to Chapter 4, Title 30, the Freedom of Information Act.

       (2) The Attorney General may publish aggregate information and statistics derived from the reports, so long as the publication does not identify individual users or disclose trade secrets.

      Section 39-81-60.  (A) The Attorney General may initiate an action in the name of the State and may seek an injunction to restrain any violations of this chapter and civil penalties of up to fifty thousand dollars for each violation.

       (1) For purposes of this subsection, a violation occurs when a covered entity fails to comply with a requirement of this act.

       (2) Each day a covered entity fails to comply with a requirement constitutes a separate violation.

    (B) A violation of this chapter constitutes an injury in fact to an affected user.

Any person harmed by a violation of this act, or a parent or legal guardian of a minor harmed by a violation of this act, may bring a civil action to recover:

       (1) monetary damages for the harm caused by the violation;

       (2) reasonable attorney's fees and costs;

       (3) injunctive or declaratory relief;

and        (4) punitive damages if the violation was wilful and wanton, reckless, or grossly negligent.

    (C)(1) The rights and remedies provided by this act may not be waived by contract.

       (2) Any term in a contract or agreement that purports to do any of the following is void and unenforceable as against public policy:

           (a) waive or limit a right or remedy under this act;

           (b) shorten the time to bring a claim under this act;

           (c) prevent a person from enforcing a claim under this act in court;

or            (d) require arbitration of a claim under this act.

    (D) The duties and obligations imposed by this act are cumulative with any other duties or obligations imposed under other law and shall not be construed to relieve any party from any duties or obligations imposed under other law and do not limit any rights or remedies under existing law.

  SECTION 3.  If any section, subsection, paragraph, subparagraph, sentence, clause, phrase, or word of this act is for any reason held to be unconstitutional or invalid, such holding shall not affect the constitutionality or validity of the remaining portions of this act, the General Assembly hereby declaring that it would have passed this act, and each and every section, subsection, paragraph, subparagraph, sentence, clause, phrase, and word thereof, irrespective of the fact that any one or more other sections, subsections, paragraphs, subparagraphs, sentences, clauses, phrases, or words hereof may be declared to be unconstitutional, invalid, or otherwise ineffective.

  SECTION 4.  This act takes effect upon approval by the Governor.

Renumber sections to conform.

Amend title to conform.

  THOMAS DAVIS for Committee.

  _______                 A bill   TO AMEND THE SOUTH CAROLINA CODE OF LAWS SO AS TO ENACT THE "CHATBOT PROTECTION ACT";

----XX---- This web page was last updated on MayFebruary 06,05, 2026 at 04:5711:34 PMAM