Six states, one playbook: the chatbot bills raising red flags
Google’s intervened on at least three of the bills
A wave of legislation targeting chatbots such as ChatGPT and Claude has emerged in six states since the start of the year, each bill strikingly similar to a recently passed Oregon law, but with new carve-outs that would shield AI companies from liability in some circumstances. Critics say these bills would lock in weaker protections for children.
“We would be cementing the status quo, where legislators feel like they did their job, they fixed the problem, and the protections are still not there for minors,” said Sam Hiner, executive director at the Young People’s Alliance, who has been tracking one of the bills in Hawaii and advocating for an alternative.
The bills — Colorado HB 1263, Hawaii SB 3001, Arizona HB 2311, Georgia SB 540, Nebraska LB 1185, and Idaho SB 1297— are each structurally similar to Oregon SB 1546 passed earlier this month, but differ in three key ways.
First, all but one of the new bills has a carve out for AI chatbots housed within another service, which would not be required to comply with the regulations. These regulations typically include requiring that a chatbot regularly clarify it is not human, that it prevent outputs that prompt suicidal thoughts and report incidents where users were referred to mental health resources to state authorities. There are also extra requirements for chatbots serving minors, such as the prohibition of sexual content. A carve-out for web applications, however, could exempt several companies with popular chatbots like Meta or Google from complying. Georgia’s bill is the one exception which does not include this carve out.
Second, these bills limit the terms under which victims can pursue legal action against companies operating chatbots. In the case of the most restrictive bills, only the attorney general has the authority to enforce the bills. This rules out private right of action, in which individual citizens can bring claims — something which commercial interests historically have argued encourages excessive or frivolous litigation. Some safety advocates find these provisions concerning, however, because they believe it significantly limits enforcement. This language “can be problematic in many states, if the AG does not have the manpower to do the enforcement,” explained Transparency Coalition cofounder Jai Jaisimha. And there can be budgetary restraints, he says. “In many states, the [AG] frequently has to ask for money.”
Last, there is careful language in each bill defining when a service must apply additional rules covering children. In Hawaii, for example, companies must have “actual knowledge or reasonable certainty” that a user is a minor in order to be held liable to the disclosure requirements, while in Arizona these requirements are strictly limited to “an account holder who is a minor.” Some safety advocates argue this allows companies which know that a user is likely a minor, but who have not been explicitly told as much by the user — in the case of free users that have not registered an account, for example — to evade the laws. Jaisimha calls these provisions a “technical loophole.”
The Chamber of Progress, however, which counts Google and OpenAI among its members, has argued that these provisions are problematic on different grounds. In the case of Hawaii, for example, it believes they could actually force tech companies to impose age verification or collect excessive data on user behaviors. “There’s no way to verify a user is a minor without being privacy invasive,” the Chamber of Progress vice president of US Policy and Government Relations Koustubh Bagchi said.
The fact that the bills are structurally similar to Oregon, but with similarly-worded industry carve-outs, suggests they were coordinated in some form. Google has voiced its support for the bills in Hawaii, Nebraska, and Arizona. Google and lawmakers sponsoring the bills in each state did not respond to requests for comment about the carve-outs listed above or about the role Google did or did not play in shaping legislation.
“This is a well-documented playbook: tech lobbyists supply full bill text and amendments, then use proxy groups to manufacture the appearance of local support,” said Marjorie Connolly, communications director at The Tech Oversight Project. “Silicon Valley is running that same playbook here, dressing it up as protecting kids from chatbots because they see it as the issue of the moment to exploit, rather than an urgent crisis that deserves real solutions.”
Bagchi framed it differently. Though he said he had not seen any model bill, he said that Google has been “consistent on what they want to see” when working with lawmakers on a provision-by-provision basis. A representative for Google suggested changes to the bill text in Hawaii during a hearing on Wednesday.
The bills are at varying stages of development. Hawaii’s bill saw the most recent action, with the hearing in the House on Wednesday, March 18 after passing the Senate last week. Idaho’s bill was amended and filed for a second reading in the Senate also on March 18. Arizona’s bill passed the House and then out of committee in the Senate on March 17. Georgia’s bill, meanwhile, passed the Senate on March 6. Nebraska’s bill is the only one that seems set to die in committee, as it has not moved since its filing in committee on February 18, and the legislative session ends next month.
The bill with the most momentum, however, is in Colorado, where a hearing initially scheduled for March 19 was postponed, likely to the following week. Advocates and industry have been outspoken in the state, in opposition and support respectively. One source who was granted anonymity to discuss their conversations with lawmakers said that potential amendments to eliminate carve-outs might be in play.