WHAT THIS BILL REGULATES · 5 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
1 As used in P.L. , c. (C. ) (pending before the Legislature as this bill): "AdvertisementAdvertisement"Advertisement" means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.N.J.S.A. 56 (section 1)" means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) and the brand, good, or service. "Affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1)" means a clear affirmative act signifying a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1), provided: a. the request is provided to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s consent is sought; c. the request is made in a manner reasonably accessible to and usable by usersUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) with disabilities; d. the request is made available to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) in each language in which the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1) to an act or practice is not inferred from the inaction of the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) or the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s continued use of a chatbot provided by the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1). "Affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1)" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patternsDark pattern"Dark pattern" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).N.J.S.A. 56 (section 1). "Artificial intelligence chatbotArtificial intelligence chatbot"Artificial intelligence chatbot" or "chatbot" means a software application, web interface, or computer program that simulates human conversation and interaction through text, visual images, video, or aural communications.N.J.S.A. 56 (section 1)" or "chatbot" means a software application, web interface, or computer program that simulates human conversation and interaction through text, visual images, video, or aural communications. "Artificial intelligence technologyArtificial intelligence technology"Artificial intelligence technology" means any technology involving the development or implementation of machine-based systems that, for explicit or implicit objectives, infer, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that may influence physical or virtual environments.N.J.S.A. 56 (section 1)" means any technology involving the development or implementation of machine-based systems that, for explicit or implicit objectives, infer, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that may influence physical or virtual environments. "Chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1)" means any input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1), outputs generated by a chatbot, or record of the input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) or outputs from userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) interactions with a chatbot. "Chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1)" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providersChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1)" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.). "CollectCollect"Collect" means to create, buy, rent, gather, obtain, receive, access, or otherwise acquire personal data or input data by any means through an individual's use of chatbots.N.J.S.A. 56 (section 1)" means to create, buy, rent, gather, obtain, receive, access, or otherwise acquire personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) by any means through an individual's use of chatbots. "Dark patternDark pattern"Dark pattern" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).N.J.S.A. 56 (section 1)" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4). "De-identified dataDe-identified data"De-identified data" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).N.J.S.A. 56 (section 1)" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4). "Input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1)" means information, including text, photographs, audio, video, or files, provided to a chatbot by a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1). "Input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1)" includes personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1). "Personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1)" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1)" does not include de-identified dataDe-identified data"De-identified data" means the same as that term is defined by section 1 of P.L.2023, c.266 (C.56:8-166.4).N.J.S.A. 56 (section 1) or publicly available informationPublicly available information"Publicly available information" means information that has been lawfully made available to the general public from: a. federal, State, or municipal government records, if the person collects, processes, and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity; b. widely distributed media; or c. a disclosure to the general public as required by federal, State, or local law. "Publicly available information" does not include: a. any obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460; b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4); c. personal data that is created through the combination of personal data with publicly available information; d. information that is collated and combined to create user profiles on publicly available or subscription-based websites and inferences generated from such information; e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains; f. information made available by a user on a website or online service made available to all members of the public, for free or for a fee, where the user has restricted the information to a specific audience; or g. intimate images, either authentic or computer-generated, known to be nonconsensual.N.J.S.A. 56 (section 1). "ProcessProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1)" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) or on sets of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1), such as the use, storage, disclosure, analysis, deletion, or modification of such data. "ProfilingProfiling"Profiling" means any form of processing performed on input data or personal data to detect and clarify or designate personality and behavioral characteristics of an individual. "Profiling" does not include the processing of chat logs for purposes of user safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).N.J.S.A. 56 (section 1)" means any form of processing performed on input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) or personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) to detect and clarify or designate personality and behavioral characteristics of an individual. "ProfilingProfiling"Profiling" means any form of processing performed on input data or personal data to detect and clarify or designate personality and behavioral characteristics of an individual. "Profiling" does not include the processing of chat logs for purposes of user safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).N.J.S.A. 56 (section 1)" does not include the processing of chat logsChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) for purposes of userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill). "Publicly available informationPublicly available information"Publicly available information" means information that has been lawfully made available to the general public from: a. federal, State, or municipal government records, if the person collects, processes, and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity; b. widely distributed media; or c. a disclosure to the general public as required by federal, State, or local law. "Publicly available information" does not include: a. any obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460; b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4); c. personal data that is created through the combination of personal data with publicly available information; d. information that is collated and combined to create user profiles on publicly available or subscription-based websites and inferences generated from such information; e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains; f. information made available by a user on a website or online service made available to all members of the public, for free or for a fee, where the user has restricted the information to a specific audience; or g. intimate images, either authentic or computer-generated, known to be nonconsensual.N.J.S.A. 56 (section 1)" means information that has been lawfully made available to the general public from: a. federal, State, or municipal government records, if the person collectsCollect"Collect" means to create, buy, rent, gather, obtain, receive, access, or otherwise acquire personal data or input data by any means through an individual's use of chatbots.N.J.S.A. 56 (section 1), processesProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1), and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity; b. widely distributed media; or c. a disclosure to the general public as required by federal, State, or local law. "Publicly available informationPublicly available information"Publicly available information" means information that has been lawfully made available to the general public from: a. federal, State, or municipal government records, if the person collects, processes, and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity; b. widely distributed media; or c. a disclosure to the general public as required by federal, State, or local law. "Publicly available information" does not include: a. any obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460; b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4); c. personal data that is created through the combination of personal data with publicly available information; d. information that is collated and combined to create user profiles on publicly available or subscription-based websites and inferences generated from such information; e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains; f. information made available by a user on a website or online service made available to all members of the public, for free or for a fee, where the user has restricted the information to a specific audience; or g. intimate images, either authentic or computer-generated, known to be nonconsensual.N.J.S.A. 56 (section 1)" does not include: a. any obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460; b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4); c. personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) that is created through the combination of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) with publicly available informationPublicly available information"Publicly available information" means information that has been lawfully made available to the general public from: a. federal, State, or municipal government records, if the person collects, processes, and transfers such information in accordance with any restrictions or terms of use placed on the information by the relevant government entity; b. widely distributed media; or c. a disclosure to the general public as required by federal, State, or local law. "Publicly available information" does not include: a. any obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460; b. biometric data; as that term is defined in section 1 of P.L.2023, c.266 (C.56:8-166.4); c. personal data that is created through the combination of personal data with publicly available information; d. information that is collated and combined to create user profiles on publicly available or subscription-based websites and inferences generated from such information; e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains; f. information made available by a user on a website or online service made available to all members of the public, for free or for a fee, where the user has restricted the information to a specific audience; or g. intimate images, either authentic or computer-generated, known to be nonconsensual.N.J.S.A. 56 (section 1); d. information that is collated and combined to create userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) profiles on publicly available or subscription-based websites and inferences generated from such information; e. genetic data, unless otherwise made publicly available by the individual to whom the information pertains; f. information made available by a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) on a website or online service made available to all members of the public, for free or for a fee, where the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) has restricted the information to a specific audience; or g. intimate images, either authentic or computer-generated, known to be nonconsensual. "SellSell"Sell" means exchanging personal data or input data for monetary or other valuable consideration, or making available such data or use of such data, by the chatbot provider to a third party. "Sell" does not include: a. the disclosure of personal data or input data to a third party that processes the data on behalf of the chatbot provider; b. with the user's affirmative consent, the disclosure of personal data or input data where the user affirmatively directs the chatbot provider to disclose the data or intentionally uses the chatbot provider to interact with a third party; or c. the disclosure of personal data that the user intentionally made available to the public through a channel of widely-distributed media and did not restrict to a specific audience.N.J.S.A. 56 (section 1)" means exchanging personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) for monetary or other valuable consideration, or making available such data or use of such data, by the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) to a third party. "SellSell"Sell" means exchanging personal data or input data for monetary or other valuable consideration, or making available such data or use of such data, by the chatbot provider to a third party. "Sell" does not include: a. the disclosure of personal data or input data to a third party that processes the data on behalf of the chatbot provider; b. with the user's affirmative consent, the disclosure of personal data or input data where the user affirmatively directs the chatbot provider to disclose the data or intentionally uses the chatbot provider to interact with a third party; or c. the disclosure of personal data that the user intentionally made available to the public through a channel of widely-distributed media and did not restrict to a specific audience.N.J.S.A. 56 (section 1)" does not include: a. the disclosure of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) to a third party that processesProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1) the data on behalf of the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1); b. with the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1), the disclosure of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) or input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) where the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) affirmatively directs the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) to disclose the data or intentionally uses the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) to interact with a third party; or c. the disclosure of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) that the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) intentionally made available to the public through a channel of widely-distributed mediaWidely-distributed media"Widely-distributed media" means information that is available to the public, including information from a telephone book or online directory, a television, the Internet, or a radio program, the news media, or an Internet site that is available to the public on an unrestricted basis. "Widely-distributed media" does not include an obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460.N.J.S.A. 56 (section 1) and did not restrict to a specific audience. "TrainingTraining"Training" means the use of input data to adjust or modify an artificial intelligence technology. "Training" does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.N.J.S.A. 56 (section 1)" means the use of input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) to adjust or modify an artificial intelligence technologyArtificial intelligence technology"Artificial intelligence technology" means any technology involving the development or implementation of machine-based systems that, for explicit or implicit objectives, infer, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that may influence physical or virtual environments.N.J.S.A. 56 (section 1). "TrainingTraining"Training" means the use of input data to adjust or modify an artificial intelligence technology. "Training" does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.N.J.S.A. 56 (section 1)" does not include: testing to identify risks of harm to usersUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1); adjustments or modifications to address identified risks of harm to usersUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1); or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law. "UserUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)" means any natural person, regardless of age. "Widely-distributed mediaWidely-distributed media"Widely-distributed media" means information that is available to the public, including information from a telephone book or online directory, a television, the Internet, or a radio program, the news media, or an Internet site that is available to the public on an unrestricted basis. "Widely-distributed media" does not include an obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460.N.J.S.A. 56 (section 1)" means information that is available to the public, including information from a telephone book or online directory, a television, the Internet, or a radio program, the news media, or an Internet site that is available to the public on an unrestricted basis. "Widely-distributed mediaWidely-distributed media"Widely-distributed media" means information that is available to the public, including information from a telephone book or online directory, a television, the Internet, or a radio program, the news media, or an Internet site that is available to the public on an unrestricted basis. "Widely-distributed media" does not include an obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460.N.J.S.A. 56 (section 1)" does not include an obscene visual depiction, as "visual depiction" is defined in 18 U.S.C. s.1460.
Section 1 supplies the operative vocabulary for the chatbot regime. The covered actor is the chatbot provider — any person or entity that creates, distributes, or makes a chatbot available — and such providers are expressly designated controllers under New Jersey's data privacy act (P.L.2023, c.266). The definition of chatbot is broad, reaching any program that simulates human conversation through text, image, video, or audio.
The section also defines the data concepts that drive every substantive duty: input data (what users provide, including personal data), chat log (inputs, outputs, and records of either), personal data, profiling, training, and a demanding affirmative consent standard that cannot be satisfied by terms-of-use acceptance, continued use, or dark patterns. These definitions create no obligations themselves but are essential to reading sections 2 through 4.
2.a 1 A chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) shall not: a. processProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1) personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) other than input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) to inform chatbot outputs unless the processing of personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) is necessary to fulfill an express request made by a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) and that userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) has provided affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1) for such processing;
2.b 2 b. processProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1) a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1): (1) to determine whether to display an advertisementAdvertisement"Advertisement" means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.N.J.S.A. 56 (section 1) for a product or service to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1); (2) to determine a product, service, or category of product or service to advertise to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1); or (3) to customize an advertisementAdvertisement"Advertisement" means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.N.J.S.A. 56 (section 1) or determine how an advertisementAdvertisement"Advertisement" means any written or oral statement, illustration, or depiction that promotes the sale or use of a good or service or is designed to increase interest in a brand, good, or service where the statement, illustration, or depiction is displayed in exchange for monetary or other valuable consideration, including access to data, between the chatbot provider and the brand, good, or service.N.J.S.A. 56 (section 1) is presented to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1);
2.c(1)-(3) 3 c. processProcess"Process" or "processing" means any operation or set of operations performed, whether by manual or automated means, on personal data or input data or on sets of personal data or input data, such as the use, storage, disclosure, analysis, deletion, or modification of such data.N.J.S.A. 56 (section 1) a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) or personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1): (1) if the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) knows or should know that the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) is under 13 years of age, without the affirmative consent of that userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s parent or legal guardian; (2) for trainingTraining"Training" means the use of input data to adjust or modify an artificial intelligence technology. "Training" does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.N.J.S.A. 56 (section 1) purposes, if the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) knows or should know, based on the knowledge fairly implied on the basis of objective circumstances, that a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) is under 18 years of age; (3) for trainingTraining"Training" means the use of input data to adjust or modify an artificial intelligence technology. "Training" does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.N.J.S.A. 56 (section 1) purposes, if a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) is over 18 years of age and the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) has not obtained the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s prior affirmative consentAffirmative consent"Affirmative consent" means a clear affirmative act signifying a user's freely given, specific, informed, and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, provided: a. the request is provided to the user in a clear and conspicuous standalone disclosure; b. the request includes a description, written in easy-to-understand language, of the act or practice for which the user's consent is sought; c. the request is made in a manner reasonably accessible to and usable by users with disabilities; d. the request is made available to the user in each language in which the chatbot provider provides a chatbot; e. the option to refuse to give consent is at least as prominent as the option to give consent, and the option to refuse to give consent takes the same number of steps or fewer as the option to give consent; and f. affirmative consent to an act or practice is not inferred from the inaction of the user or the user's continued use of a chatbot provided by the chatbot provider. "Affirmative consent" does not include: a. acceptance of a general or broad terms of use or similar agreement; b. hovering over, muting, pausing, or closing a given piece of content; c. agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation; or d. agreement obtained through the use of dark patterns.N.J.S.A. 56 (section 1); or
2.c(4) & 2.d 4 to engage in profilingProfiling"Profiling" means any form of processing performed on input data or personal data to detect and clarify or designate personality and behavioral characteristics of an individual. "Profiling" does not include the processing of chat logs for purposes of user safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).N.J.S.A. 56 (section 1) beyond what is necessary to fulfill an express request from the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1); d. use any classification or designation of a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s personality or behavioral characteristics created through profilingProfiling"Profiling" means any form of processing performed on input data or personal data to detect and clarify or designate personality and behavioral characteristics of an individual. "Profiling" does not include the processing of chat logs for purposes of user safety or for compliance with P.L. , c. (C. ) (pending before the Legislature as this bill).N.J.S.A. 56 (section 1) beyond what is necessary to fulfill an express request made by a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1);
2.e 5 e. sellSell"Sell" means exchanging personal data or input data for monetary or other valuable consideration, or making available such data or use of such data, by the chatbot provider to a third party. "Sell" does not include: a. the disclosure of personal data or input data to a third party that processes the data on behalf of the chatbot provider; b. with the user's affirmative consent, the disclosure of personal data or input data where the user affirmatively directs the chatbot provider to disclose the data or intentionally uses the chatbot provider to interact with a third party; or c. the disclosure of personal data that the user intentionally made available to the public through a channel of widely-distributed media and did not restrict to a specific audience.N.J.S.A. 56 (section 1) a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1);
2.f 6 f. retain a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) for longer than two years, unless retention is necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or is otherwise required by law;
2.g 7 g. discriminate or retaliate against any userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1), including by denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1), for refusing to consent to the use of a chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) or personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) for trainingTraining"Training" means the use of input data to adjust or modify an artificial intelligence technology. "Training" does not include: testing to identify risks of harm to users; adjustments or modifications to address identified risks of harm to users; or any actions necessary to comply with P.L. , c. (C. ) (pending before the Legislature as this bill) or otherwise required by law.N.J.S.A. 56 (section 1) purposes or for accessing the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1); or
2.h 8 h. (1) use any term, letter, or phrase in advertising interface, or outputs of a chatbot that indicate or imply that any output data is being provided by, endorsed by, or equivalent to those provided by a profession or occupation regulated pursuant to Title 45 of the Revised Statutes or by the Judicial Branch of State government or the Administrative Office of the Courts. This includes any representations that a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s input dataInput data"Input data" means information, including text, photographs, audio, video, or files, provided to a chatbot by a user. "Input data" includes personal data.N.J.S.A. 56 (section 1) or chat logChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) is confidential. (2) It shall be an unlawful practice and a violation of P.L.1960, c.39 (C.56:8-1 et seq.) for a chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) to violate this subsection.
Section 2 is the core prohibitions provision. It restricts how a chatbot provider may process data: personal data beyond input data may be used to inform outputs only where necessary to fulfill a user's express request and only with affirmative consent, and chat logs may not be processed to target or customize advertising at all.
The section sets a tiered consent regime for chat-log and personal-data processing based on user age — parental affirmative consent for users under 13, an outright ban on training using data of users reasonably believed to be under 18, and an affirmative-consent prerequisite for training on adults' data. It bars selling chat logs, retaining them beyond two years, and discriminating or retaliating against users who refuse training consent or who access their own chat logs. Finally, providers may not use any term or interface that implies outputs come from, are endorsed by, or are equivalent to a Title 45 licensed profession or the Judicial Branch — including false confidentiality claims — with that subsection expressly deemed an unlawful practice under the Consumer Fraud Act.
3.a 9 A chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) shall: a. make information about its chatbot available on the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1)'s Internet website as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill);
3.b 10 b. retain in a portable and readily-usable format and make available for a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) to access and download at any time any of the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1)'s chat logsChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1);
3.c 11 c. develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal dataPersonal data"Personal data" means any information, including derived data, inferences, or unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or a device that identifies or is linked or is reasonably linkable to an individual. "Personal data" does not include de-identified data or publicly available information.N.J.S.A. 56 (section 1) and chat logsChat log"Chat log" means any input data, outputs generated by a chatbot, or record of the input data or outputs from user interactions with a chatbot.N.J.S.A. 56 (section 1) maintained by the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1). The program shall be written and made publicly available on the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1)'s Internet website;
3.d & 3.e 12 d. assess its chatbot for risks of harm to usersUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) on a monthly basis, according to metrics as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill); and e. mitigate any risks of harm as set forth in rules promulgated by the Attorney General pursuant to section 6 of P.L. , c. (C. ) (pending before the Legislature as this bill).
Section 3 imposes affirmative operating duties on chatbot providers. Providers must publish prescribed information about the chatbot on their website per Attorney General rules, retain each user's chat logs in a portable, readily-usable format and allow the user to access and download them at any time, and maintain a written, publicly posted comprehensive data security program with administrative, technical, and physical safeguards proportionate to the data they hold.
The section also requires a recurring safety cadence: providers must assess the chatbot for risks of harm to users on a monthly basis against metrics set by the Attorney General and mitigate any identified risks under those rules. Much of the operational detail is delegated to future AG rulemaking under section 6.
4.a-c 13 a. A chatbot shall be considered a product for the purposes of a product liability action. b. A chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) shall have a duty to ensure that the use of its chatbot does not cause injury to a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1). c. A chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) shall be liable for any injury to a userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) from the use of its chatbot, even if: (1) the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) exercised all reasonable care in the design and distribution of the chatbot; or (2) the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) did not directly distribute the chatbot to the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) or otherwise enter into a contractual relationship with the userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1).
Section 4 is the bill's most consequential liability provision. It classifies a chatbot as a product for product-liability purposes and imposes on providers an affirmative duty to ensure the chatbot's use does not cause user injury. Critically, the section makes providers liable for user injury even where they exercised all reasonable care in design and distribution and even absent any contractual or direct-distribution relationship with the user — a strict-liability framing that removes both the reasonable-care defense and privity as defenses.
5.a a. A chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) that violates the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall be subject to a civil penalty of $5,000 for each violation, to be collected in a civil action by a summary proceeding under the "Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10 et seq.). The Superior Court and the municipal court shall have jurisdiction to enforce the provisions of the "Penalty Enforcement Law of 1999," P.L.1999, c.274 (C.2A:58-10) pursuant to this section.
5.b b. The Attorney General may bring a civil action for injunctive relief against a chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) who violates the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) or any rules, regulation, or orders promulgated thereunder.
5.c c. (1) A userUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) who has been harmed by a violation of sections 2 or 3 of P.L. , c. (C. or C. ) (pending before the Legislature as this bill) may bring a civil action against the chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1). An action pursuant to this subsection shall be brought in the Superior Court of the county in which the individual bringing the action resides. (2) If a court finds that a chatbot providerChatbot provider"Chatbot provider" means any individual, partnership, association, firm, or business entity, or any member, affiliate, subsidiary, or beneficial owner of any partnership, association, firm, or business entity who creates, distributes, or otherwise makes available a chatbot. "Chatbot providers" are controllers for the purpose of P.L.2023, c.266 (C.56:8-166.4 et seq.).N.J.S.A. 56 (section 1) has violated sections 2 or 3 of P.L. , c. (C. or C. ) (pending before the Legislature as this bill), the individual bringing an action pursuant to this section shall be entitled to: (a) the greater of actual damages or $5,000 for each violation; and (b) reasonable attorney fees and court costs.
Section 5 establishes the enforcement architecture. A violating chatbot provider faces a civil penalty of $5,000 per violation collectible by summary proceeding under the Penalty Enforcement Law of 1999, and the Attorney General may separately sue for injunctive relief against violations of the act or its implementing rules.
The section also creates a private right of action: a user harmed by a violation of sections 2 or 3 may sue the provider in Superior Court and, if successful, recover the greater of actual damages or $5,000 per violation plus reasonable attorney fees and court costs. This is an enforcement provision and creates no independent compliance duty of its own.
6 The Attorney General shall adopt, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), rules and regulations as may be necessary to implement the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill).
Section 6 delegates implementing rulemaking to the Attorney General under the Administrative Procedure Act. The substantive content of several section 3 duties — website disclosure contents, monthly risk-of-harm metrics, and risk-mitigation standards — will be fleshed out in future regulations, so product counsel should monitor AG rulemaking for operational specifics.
7.a & 7.b a. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not limit or restrict in any way the application of other laws, statutes, rules, or regulations of this State. b. In the event of a conflict between P.L. , c. (C. ) (pending before the Legislature as this bill) and one or more other laws of this State, the law that affords the greatest protection from harm to usersUser"User" means any natural person, regardless of age.N.J.S.A. 56 (section 1) shall control.
Section 7 is a construction clause. It provides that the act does not limit the application of other New Jersey laws and that, where this act conflicts with another state law, the law affording the greatest protection from harm to users controls. It imposes no independent compliance obligation.
8 This act shall take effect on the first day of the sixth month following the date of enactment. However, the Attorney General may take any anticipatory action in advance as shall be necessary for the implementation of this act.
Section 8 sets the operative date: the act takes effect on the first day of the sixth month following enactment, while permitting the Attorney General to take anticipatory implementation action in advance. No compliance obligation is created by this provision.