This Iowa bill (HF 2715) sets safety rules for public-facing chatbots, primarily affecting companies that deploy them. It requires deployers to clearly disclose when users interact with AI (not humans), implement safety protocols for self-harm risks, and limit data collection. For minors, it mandates age-verification methods (without requiring ID), parental notifications for self-harm, and strict criteria for therapeutic chatbots - requiring professional recommendations, clinical evidence, and safety testing before use by minors. The bill does not ban chatbots but imposes compliance requirements for deployers to protect user safety.
HF 2274 requires operators of internet sites, apps, or site/app segments containing a significant portion of material deemed "pornographic for minors" to implement reasonable age verification. This prevents minors from accessing such content using methods like digital ID checks, commercially reasonable transactional data analysis, or attorney general-approved approaches. The law exempts bona fide news organizations, public interest broadcasts, and internet service providers (unless they created the content). Violations carry civil penalties up to $1,000 per incident, enforced by the attorney general.
HF 2606 requires websites, apps, or sections of sites/apps containing a significant portion of material deemed "pornographic for minors" to implement age verification to block access by users under 18. It defines "pornographic for minors" and allows three verification methods: digital ID, commercially reasonable transactional data checks, or attorney-general-approved methods. Exemptions include news organizations, public broadcasts, and internet service providers (unless they created the content). Violations carry civil penalties up to $1,000 per access (capped at $10,000 daily), enforced by the attorney general, with strict privacy rules prohibiting retention of identifying data.
This Iowa bill regulates chatbot deployers by requiring safety protocols to detect and mitigate user harm, while limiting data collection to what's necessary for the chatbot's purpose. It mandates age verification to prevent minors from accessing chatbots, with exceptions for mental health chatbots that provide clinical evidence, professional recommendations, and clear disclaimers about their non-professional nature. Deployers must document testing and disclose limitations to parents/guardians for minor-accessible mental health chatbots. Violations may result in civil penalties up to $2,500 per incident.
HF 2204 regulates chatbot developers and companies (called "deployers") that make AI chatbots publicly available. It requires deployers to implement safety protocols to detect and mitigate harm, limit user data collection to what's necessary, and verify users' ages to prevent minors from accessing certain chatbots. Specifically, it bans AI companions that simulate emotional bonds from being used by minors without age verification, prohibits impersonating people without permission (with limited exceptions), and sets strict rules for therapeutic chatbots (like mental health tools) to include disclaimers, professional recommendations, and safety testing. Violations can result in civil penalties up to $2,500 per incident or allow minors to sue for damages. The law does not apply to generic chatbots offering only basic responses without creating emotional connections.
SF 207 requires commercial online platforms ("covered platforms") that publish or distribute obscene material to verify the age of users attempting to access it. If a platform fails this "reasonable age verification" and a minor accesses the material, the platform could face civil lawsuits for damages (including punitive damages up to three times attorney fees) and must not retain or sell the user's age verification data. The bill permits third-party verification using methods like government ID or cryptographic techniques to protect privacy. It explicitly excludes liability for regular internet users and providers merely connecting to content, and enforcement would only occur through private lawsuits - not by state authorities.
HF 278, the "Social Media Parental Authorization Act," requires social media companies operating in Iowa to obtain parental permission before allowing minors (under 18) to create accounts. Companies must verify parental authorization - either in writing or through a digital process - and cannot collect or store data about minors without it. Parents or guardians who grant permission gain full access to monitor their child’s posts, messages, privacy settings, and screen time, and can revoke authorization at any time. Violations could result in civil penalties of up to $1,000 per violation for companies, or $10,000 per violation for harmed individuals seeking damages in court.
HF 798, the "Social Media Parental Authorization Act," requires social media companies operating in Iowa to obtain prior parental authorization before allowing minors (under 18) to create accounts. This authorization must be either written or digital, verified by the platform, and grants parents access to monitor their child’s posts, messages, account settings, and usage time. The bill prohibits companies from collecting or storing minor data without authorization and bans account creation if minors are already restricted by other state or federal laws. Violations can result in civil penalties up to $1,000 per violation for companies, or $10,000 per violation plus actual damages for harmed individuals.
This Iowa bill (SF 443) requires commercial websites ("covered platforms") that regularly publish or distribute obscene material online to verify users' ages using methods like government IDs or financial documents. It prohibits these platforms from retaining or selling users' age verification data after checks are completed, while allowing privacy-preserving techniques like zero-knowledge proofs. Violations could result in civil penalties up to $10,000 per offense, enforced by the state attorney general. The law explicitly excludes liability for internet users, basic service providers (like ISPs), or platforms merely connecting to third-party content.
