Regulon — SC-HB-5476 · SC HB 5476 (Protecting Children from Chatbots)

WHAT THIS BILL REGULATES · 6 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney General enforcement and private right of action. The Attorney General may initiate an action in the name of the State seeking injunction and civil penalties. Any person harmed by a violation, or a parent or guardian of a minor harmed, may bring a civil action. Contractual waivers of rights and remedies, shortened limitation periods, forum selection clauses preventing court enforcement, and mandatory arbitration clauses are void and unenforceable.

Private Right of Action

private right of action.

Penalties

AG enforcement: injunctive relief and civil penalties up to $50,000 per violation; each day of noncompliance constitutes a separate violation. Private action: monetary damages for harm caused, reasonable attorney fees and costs, injunctive or declaratory relief, and punitive damages if the violation was willful and wanton, reckless, or grossly negligent. Private plaintiffs must show harm caused by the violation. Rights and remedies may not be waived by contract; mandatory arbitration clauses are void.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

S.C. Code § 39-81-10

Definitions

(1)–(22) As used in this chapter: (1) "Affiliate" means any person or entity that directly or indirectly controls, is controlled by, or is under common control with another person or entity. (2) "Age verification data" means personal information collected solely to confirm a person's age. (3) "Authorized minor account" means a user account for a minor for which the covered entity has obtained verifiable parental consent. (4) "Chatbot" means any artificial intelligence, algorithmic, or automated system that: (a) produces new expressive content or responses not fully predetermined by the operator of the service or application; (b) accepts open-ended, natural-language, or multimodal user input and produces adaptive or context-responsive natural language output; and (c) maintains a conversational state across exchanges and is designed to facilitate multi-turn dialogue rather than to respond to discrete information requests. (5) "Control" means the power to direct the management or policies of an entity, whether through ownership, contract, or otherwise. (6)(a) "Covered entity" means an operator of a chatbot that has five hundred thousand or more monthly active users worldwide. A covered entity does not include an operator of a chatbot that is: (i) not offered to the general public, such as internal workplace tools, clinician-supervised clinical tools, or university research systems; or (ii) used by a business entity solely for customer service or to strictly provide users with information about available commercial services or products provided by that entity, customer service account information, or other information strictly related to its customer service. (b) For purposes of determining monthly active users, a covered entity shall aggregate monthly active users across all chatbots offered by the covered entity and its affiliates. (7) "Covered harm" means harm suffered by a user, including death, a suicide attempt, self-harm requiring medical attention, a psychiatric emergency resulting in urgent medical treatment, or a serious physical injury that requires medical attention. (8) "Covered incident" means an incident in which a user suffered a covered harm arising from interactions with a chatbot. (9) "Duty of loyalty" means that the covered entity shall not, in the design or operation of its chatbot, place the covered entity's interests in material conflict with the interests of the user to the user's detriment. (10) "Emotional dependence" means a pattern of user behavior or statements indicating that the user relies on a chatbot as a primary source of emotional support or social connection, such as a user expressing that the chatbot is his primary source of emotional support, a user expressing distress at the prospect of losing access to the chatbot, or patterns of use suggesting the user is substituting the chatbot for human relationships. (11) "Explicit content" means: (a) any description or representation of nudity, sexual conduct, sexual excitement, or sadomasochistic abuse when the content predominantly appeals to the prurient, shameful, or morbid interest of minors; is patently offensive to prevailing standards in the adult community as a whole with respect to what is suitable material for minors; and is, when taken as a whole, lacking in serious literary, artistic, political, or scientific value for minors; (b) content that provides specific instructions for, or that glorifies or promotes suicide, self-injury, or disordered eating behaviors; or (c) graphic depictions of extreme violence that lack serious literary, artistic, political, or scientific value for minors. (12) "Limited-access mode" means a mode of interacting with a chatbot in which the user does not need to create a user account or provide age verification data. Accounts in limited-access mode do not make any of the restricted features available. (13) "Monthly active user" means a unique user who interacts with a chatbot at least once during a thirty-day period, as measured using the operator's ordinary business records. (14) "Operator" means any person or entity that owns, controls, offers, or makes available a website, mobile application, or digital service that provides a chatbot to users in this State. (15) "Reasonable age verification" includes methods authenticated to relate to the individual, such as a state-issued identification or driver license; government digital identification; military identification; bank account verification; or any other commercially reasonable means or method, including third-party verifiers that can reliably and accurately independently verify a user is an adult. (16) "Restricted feature" means: (a) personalization based on a user profile or prior sessions; (b) proactive outreach to the user, including notifications or messages initiated by the chatbot or operator; (c) extended interaction sessions or long context windows that may pose an unreasonable risk of the user developing emotional dependence or covered harm; (d) relationship simulation, meaning designing or marketing the chatbot to simulate a personal relationship with the user, including portraying the chatbot as a friend, romantic partner, therapist, or primary source of emotional support; or (e) access to explicit content. (17) "Parental account" means an account with the operator that is: (a) verified to be established by an individual who the operator has determined is at least eighteen years of age through the operator's age verification method or process; and (b) affiliated with one or more accounts of a user or prospective user who is a minor. (18) "Parental control functions" means settings that allow a parent to restrict the minor user's account, including, but not limited to: (a) limiting the minor's interaction time; (b) restricting or disabling categories of content or features, including but not limited to, restricted features; (c) receiving the notifications required under this act; and (d) deleting the minor user's data. (19) "Unverified user" means a user whose age has not been verified by the covered entity pursuant to Section 39-81-20. (20) "User" means an individual who interacts with a chatbot. (21) "Verifiable parental consent" means authorization provided by a parent who has completed reasonable age verification in response to a clear and conspicuous disclosure signifying freely given, specific, informed, and unambiguous agreement. (22) "Verified adult account" means a user account that a covered entity has verified, using a reasonable age verification process, to belong to an adult.

Section 39-81-10 establishes 22 defined terms for the chapter. Key definitional choices include: Chatbot requires multi-turn conversational state and adaptive output — excluding one-shot Q&A tools. Covered entity is limited to operators with 500,000+ monthly active users worldwide, aggregated across affiliates, and carves out internal workplace tools, clinician-supervised clinical tools, university research systems, and customer-service-only bots. The definition of restricted features creates a tiered access model by identifying five feature categories — personalization, proactive outreach, extended sessions, relationship simulation, and explicit content — that are locked behind age verification.

The duty of loyalty is defined as a prohibition on placing the covered entity's interests in material conflict with the user's interests to the user's detriment, a framing borrowed from fiduciary law. Emotional dependence is defined by behavioral indicators (reliance on the bot as a primary source of emotional support, distress at loss of access, substitution for human relationships) rather than by clinical criteria.

S.C. Code § 39-81-20

Limited-access mode, age verification, and restricted feature gating

Deployer

(A)(1) 1 A covered entity shall make a limited-access mode available and shall ensure that any unverified user may only access and interact with a chatbot in limited-access mode.

(B)(1)–(3) 2 Before enabling any restricted feature for a user, a covered entity shall: (1) require the user to create a user account; (2) verify the user's age using a reasonable age verification process, subject to item (3); and (3) using the age data, classify the user as a minor or an adult.

(C)(1)–(6) 3 When conducting reasonable age verification process under this section, an operator shall: (1) collect only the age verification data that is strictly necessary to reasonably verify age; (2) use age verification data only for age verification; (3) not sell, rent, share, or otherwise disclose age verification data to any third party, except to a service provider performing age verification under a contract prohibiting further disclosure; (4) not combine age verification data with any other personal data about the user; (5) delete age verification data within twenty-four hours of completing the age verification process, except that the operator may retain a record that the user has been verified as a minor; and (6) provide a simple process for a user to appeal or correct an age-verification decision.

(D) If the reasonable age verification process classifies the user as an adult, then the covered entity may enable restricted features for the verified adult account.

(E) 4 If the age verification process classifies the user as a minor, then a covered entity shall not enable any restricted feature unless the user is using an authorized minor account subject to Section 39-81-30.

(F) 5 A covered entity shall implement reasonable systems and processes to identify user accounts that may be inaccurately classified by age, such as patterns of use suggesting a minor is using an adult account or credible reports that an account was created using false age data, and shall re-verify any such account before enabling any restricted feature.

(G) A covered entity shall not be liable under this chapter solely because a minor incidentally uses a user account that has been correctly verified and classified as an adult account, provided the covered entity is otherwise in compliance with subsection (F).

(H) 6 With respect to each user account of a covered entity that exists as of the effective date of this act, a covered entity shall, within sixty days, disable access to restricted features for any account that has not been classified as an authorized minor account or a verified adult account, unless and until the user completes age verification.

Section 39-81-20 establishes the bill's core access-control architecture. All users start in limited-access mode — no account required, no restricted features available. Before any restricted feature can be enabled, the covered entity must require account creation, conduct reasonable age verification, and classify the user as a minor or adult. Subsection (C) imposes strict data minimization rules on the age-verification process itself: collect only what is necessary, use it only for verification, do not sell or share it, do not combine it with other personal data, and delete it within 24 hours.

Subsections (F) and (H) address ongoing compliance: covered entities must proactively monitor for misclassified accounts and re-verify them, and must retroactively disable restricted features on pre-existing accounts that have not been verified within 60 days of the act's effective date. Subsection (G) provides a safe harbor against liability when a minor incidentally uses a correctly verified adult account, provided the entity has complied with the misclassification-detection obligation.

Compliance actions 6 items

Covered entities must make a limited-access mode available for their chatbot and must ensure that any unverified user — one whose age has not been verified — may only access and interact with the chatbot in limited-access mode, which disables all restricted features (personalization, proactive outreach, extended sessions, relationship simulation, and explicit content) and does not require account creation or age verification data.

MN-01.1

Before enabling any restricted feature for a user, covered entities must (1) require the user to create a user account, (2) verify the user's age using a reasonable age verification process, and (3) classify the user as a minor or an adult based on the age data collected.

MN-01.1

When conducting age verification, covered entities must (1) collect only age verification data strictly necessary to verify age, (2) use that data only for age verification, (3) not sell, rent, share, or disclose it to any third party except a service provider performing age verification under a contract prohibiting further disclosure, (4) not combine it with any other personal data about the user, (5) delete it within 24 hours of completing verification (except that the entity may retain a record that the user is a minor), and (6) provide a simple process for a user to appeal or correct an age-verification decision.

D-01.6

If the age verification process classifies a user as a minor, covered entities must not enable any restricted feature unless the user is using an authorized minor account — i.e., an account for which verifiable parental consent has been obtained under Section 39-81-30.

MN-01.1

Covered entities must implement reasonable systems and processes to identify user accounts that may be inaccurately classified by age — such as patterns of use suggesting a minor is using an adult account or credible reports of false age data — and must re-verify any such account before enabling any restricted feature.

MN-01.1

Within 60 days of the act's effective date, covered entities must disable access to restricted features for every pre-existing user account that has not been classified as an authorized minor account or a verified adult account, and must keep those features disabled until the user completes age verification.

MN-01.1

S.C. Code § 39-81-30

Parental consent and authorized minor accounts

Deployer

(A) Nothing in this act shall be construed to require parental consent for a minor to access or interact with a chatbot in limited-access mode.

(B) 7 If the age verification process described in Section 39-81-20 classifies a user as a minor and the user seeks to access any restricted feature, then a covered entity shall offer the user the option of continuing to use the chatbot in limited-access mode or to obtain parental consent to access the restricted features.

(C)(1)–(6) 8 If the user chooses to get parental consent, then the covered entity shall: (1) obtain verifiable parental consent; (2) remove limited-access mode and enable access to restricted features; (3) ensure that the chatbot continues to restrict access to any explicit content; (4) implement reasonable parental control functions, which may restrict the minor's access to features enabled under item (2); (5) offer the parent the option to provide contact information or establish a linked parental account in order to receive notifications; and (6) offer the parent the option to receive access to chat logs of any interactions between the minor and the chatbot conducted through the authorized minor account.

(D) 9 If the age verification process classifies the user as under sixteen, then a covered entity also shall require the consenting parent to provide contact information or establish a linked parental account.

(E) 10 If the covered entity has a way to reach the parent through a parental account or contact information provided under subsection (C) or (D), then the covered entity shall notify the parent immediately in the case of any incident provoking a crisis message, pursuant to Section 39-81-40(B)(3).

Section 39-81-30 governs access for users classified as minors. Subsection (A) clarifies that limited-access mode requires no parental consent — minors may always use the chatbot in that mode. Subsections (B) and (C) establish the parental-consent pathway: if a minor seeks restricted features, the covered entity must obtain verifiable parental consent, enable restricted features except explicit content, implement parental control functions, and offer the parent the option of a linked parental account, notifications, and access to chat logs.

Subsection (D) adds a heightened requirement for users classified as under 16: the consenting parent must (not merely may) provide contact information or establish a linked parental account. Subsection (E) requires the covered entity to immediately notify the parent whenever a crisis message is triggered under § 39-81-40(B)(3), provided the entity has parental contact information.

Compliance actions 4 items

When a user classified as a minor seeks to access any restricted feature, the covered entity must offer the user the option to either continue using the chatbot in limited-access mode or obtain parental consent to access restricted features.

MN-01.2

When a minor elects to obtain parental consent for restricted features, the covered entity must (1) obtain verifiable parental consent, (2) enable restricted features but continue to block all explicit content, (3) implement reasonable parental control functions — including time limits, content/feature restrictions, notifications, and data deletion — (4) offer the parent the option to provide contact information or establish a linked parental account for notifications, and (5) offer the parent the option to receive access to chat logs of the minor's interactions.

MN-01.2

For users classified as under 16, covered entities must require the consenting parent to provide contact information or establish a linked parental account — this is mandatory rather than optional for this age group.

MN-01.2

When a crisis message is triggered under § 39-81-40(B)(3) for a minor account holder, the covered entity must immediately notify the parent through any parental account or contact information the entity has on file.

MN-01.10

S.C. Code § 39-81-40

Prohibited features and required safety systems

Deployer

(A)(1)–(2) 11 A covered entity shall not implement features designed to: (1) prioritize engagement, revenue, or retention metrics, such as session length, frequency of use, or emotional engagement, at the expense of user wellbeing; or (2) encourage or facilitate a minor user or unverified user concealing the user's use of the chatbot from a parent or guardian.

(B)(1) 12 A covered entity shall implement reasonable systems and processes to: (1) identify when a user is developing emotional dependence on the chatbot and take reasonable steps to reduce that dependence and associated risks of harm;

(B)(2) 13 A covered entity shall implement reasonable systems and processes to: (2) ensure that a chatbot does not make a materially false representation that it is a human being;

(B)(3) 14 A covered entity shall implement reasonable systems and processes to: (3) identify when a user is expressing suicidal thoughts, intent to self-harm, or showing signs of an acute mental health crisis and shall promptly provide a clear and prominent crisis message, including crisis services information to any such user.

Section 39-81-40 imposes two categories of obligations: prohibitions on harmful design features and affirmative safety-system requirements. Subsection (A) prohibits features designed to (1) prioritize engagement, revenue, or retention metrics at the expense of user wellbeing, and (2) encourage minors or unverified users to conceal chatbot use from parents. These are design-level prohibitions — they target features that are designed to produce the prohibited outcome, not features that incidentally do so.

Subsection (B) requires covered entities to implement reasonable systems to (1) identify emotional dependence and take steps to reduce it, (2) prevent the chatbot from falsely claiming to be human, and (3) detect expressions of suicidal thoughts, self-harm intent, or acute mental health crisis and promptly provide crisis messages with crisis services information. The emotional-dependence detection obligation is distinctive — it goes beyond crisis response to require the entity to affirmatively monitor for and mitigate a pattern of harmful user behavior.

Compliance actions 4 items

Covered entities must not implement features designed to (1) prioritize engagement, revenue, or retention metrics — such as session length, frequency of use, or emotional engagement — at the expense of user wellbeing, or (2) encourage or facilitate a minor or unverified user concealing the user's chatbot use from a parent or guardian.

CP-01.1

Covered entities must implement reasonable systems and processes to identify when a user is developing emotional dependence on the chatbot — such as relying on it as a primary source of emotional support, expressing distress at loss of access, or substituting it for human relationships — and must take reasonable steps to reduce that dependence and associated risks of harm.

MN-01.5

Covered entities must implement reasonable systems and processes to ensure that a chatbot does not make a materially false representation that it is a human being.

T-01.3

Covered entities must implement reasonable systems and processes to identify when a user is expressing suicidal thoughts, intent to self-harm, or showing signs of an acute mental health crisis, and must promptly provide a clear and prominent crisis message — including crisis services information — to any such user.

S-04.1

S.C. Code § 39-81-50

Emergency notification and incident reporting

Deployer

(A)(1)–(3) 15 If a covered entity obtains knowledge that a user faces an imminent risk of death or serious physical injury, then the operator must make reasonable efforts, within twenty-four hours, to notify appropriate emergency services or law enforcement, to the extent practicable based on information the operator already possesses or can obtain through reasonable, user-facing prompts for the purpose of facilitating emergency assistance. (2) If the operator cannot make a notification under item (1) because the operator lacks sufficient information to enable an emergency response, then the operator shall: (a) promptly provide a clear and prominent message urging the user to contact emergency services and provide crisis services information, (b) make reasonable efforts to encourage the user to seek immediate help from a trusted adult or emergency services, and (c) document the steps taken and the basis for the operator's determination that notification was not practicable. (3) An operator that makes a notification in good faith under this subsection is not liable for damages solely for making the notification, unless the operator acted with willful misconduct or gross negligence.

(B)(1)–(2) 16 A covered entity shall submit a report to the Attorney General within fifteen days of obtaining knowledge of a covered incident connected to one or more of its chatbots, which, to the extent known at the time of the report, shall include: (a) the date the operator obtained knowledge of the incident; (b) the date of the incident, if known; (c) a brief description of the incident and the basis for the operator's belief that the incident is connected to the chatbot; and (d) a description of any actions the operator took in response. (2) A covered entity may submit a supplemental report within sixty days after the initial report to update or correct information learned through investigation.

(C)(1)–(2) Reports submitted under this section shall be confidential and are not subject to disclosure pursuant to Chapter 4, Title 30, the Freedom of Information Act. (2) The Attorney General may publish aggregate information and statistics derived from the reports, so long as the publication does not identify individual users or disclose trade secrets.

Section 39-81-50 creates two distinct obligations: an emergency-notification duty and an incident-reporting duty to the Attorney General. Subsection (A) requires operators who obtain knowledge that a user faces imminent risk of death or serious physical injury to make reasonable efforts within 24 hours to notify emergency services or law enforcement. If the operator lacks sufficient information for emergency notification, it must provide the user with a crisis message, encourage the user to seek help, and document the steps taken. Subsection (A)(3) provides a good-faith safe harbor for emergency notifications absent willful misconduct or gross negligence.

Subsection (B) requires covered entities to report covered incidents — involving death, suicide attempts, self-harm requiring medical attention, psychiatric emergencies, or serious physical injury connected to chatbot interactions — to the Attorney General within 15 days. Reports are confidential and exempt from FOIA. The AG may publish aggregate statistics that do not identify users or disclose trade secrets.

Compliance actions 2 items

When a covered entity obtains knowledge that a user faces imminent risk of death or serious physical injury, the operator must make reasonable efforts within 24 hours to notify appropriate emergency services or law enforcement, based on information the operator already possesses or can obtain through reasonable user-facing prompts. If the operator lacks sufficient information for emergency notification, it must instead (a) promptly display a clear and prominent message urging the user to contact emergency services with crisis services information, (b) encourage the user to seek immediate help from a trusted adult or emergency services, and (c) document the steps taken and the basis for determining that notification was not practicable. Good-faith notifications are protected from liability absent willful misconduct or gross negligence.

R-01.4

Covered entities must submit a report to the Attorney General within 15 days of obtaining knowledge of a covered incident — defined as an incident in which a user suffered death, a suicide attempt, self-harm requiring medical attention, a psychiatric emergency requiring urgent treatment, or serious physical injury arising from chatbot interactions. The report must include, to the extent known: (a) the date the operator learned of the incident, (b) the date of the incident, (c) a brief description of the incident and the basis for believing it is connected to the chatbot, and (d) a description of actions taken in response. The entity may submit a supplemental report within 60 days to update or correct information. Reports are confidential and exempt from FOIA.

R-01.1

S.C. Code § 39-81-60

Enforcement, remedies, and non-waivability

(A)(1)–(2) The Attorney General may initiate an action in the name of the State and may seek an injunction to restrain any violations of this chapter and civil penalties of up to fifty thousand dollars for each violation. (1) For purposes of this subsection, a violation occurs when a covered entity fails to comply with a requirement of this act. (2) Each day a covered entity fails to comply with a requirement constitutes a separate violation.

(B)(1)–(4) Any person harmed by a violation of this act, or a parent or legal guardian of a minor harmed by a violation of this act may bring a civil action to recover: (1) monetary damages for the harm caused by the violation; (2) reasonable attorney fees and costs; (3) injunctive or declaratory relief; and (4) punitive damages if the violation was wilful and wanton, reckless, or grossly negligent.

(C)(1)–(2) The rights and remedies provided by this act may not be waived by contract. (2) Any term in a contract or agreement that purports to do any of the following is void and unenforceable as against public policy: (a) waive or limit a right or remedy under this act; (b) shorten the time to bring a claim under this act; (c) prevent a person from enforcing a claim under this act in court; or (d) require arbitration of a claim under this act.

(D) The duties and obligations imposed by this act are cumulative with any other duties or obligations imposed under other law and shall not be construed to relieve any party from any duties or obligations imposed under other law and do not limit any rights or remedies under existing law.

Section 39-81-60 establishes a dual enforcement regime: Attorney General enforcement with civil penalties up to $50,000 per violation (each day of noncompliance counting as a separate violation) plus injunctive relief, and a private right of action for any person harmed or a parent/guardian of a minor harmed. Private plaintiffs may recover monetary damages, reasonable attorney fees and costs, injunctive or declaratory relief, and punitive damages where the violation was willful and wanton, reckless, or grossly negligent.

Subsection (C) renders void and unenforceable any contractual term that waives rights under the act, shortens limitation periods, prevents court enforcement, or requires arbitration. Subsection (D) is a savings clause preserving cumulative duties and remedies under other law.

Minor Safety Parental consent · controls · termination workflows

10 items

MN-01.1

MN-01.2

MN-01.10

MN-01.5

Transparency AI identity disclosure · periodic reminders

1 item

T-01.3

Covered entities must implement reasonable systems and processes to ensure that a chatbot does not make a materially false representation that it is a human being.

Safety Harmful content prevention · self-harm escalation

1 item

S-04.1