You’re reading the Benton Institute for Broadband & Society’s Weekly Digest, a recap of the biggest (or most overlooked) broadband stories of the week. The digest is delivered via e-mail each Friday.

Round-Up for the Week of January 19-23, 2026

This week, the Consumer Federation of America (CFA), the Electronic Privacy Information Center (EPIC), and the nonprofit Fairplay released model legislation for a People-First Model Chatbot Bill. The People-First Chatbot Bill intends to give lawmakers a straightforward approach to address the harms caused by artificial intelligence (AI) chatbot products developed and deployed by tech companies with little oversight or transparency. Rather than outlawing chatbots, the model bill provides a workable, clear framework to encourage the development of safer technology.

A Future-Focused Bill to Combat Existing Harms

The authors of the People-First Chatbot Bill—CFA Director of AI and Privacy Ben Winters, EPIC Counsel Kara Williams, and Fairplay Staff Attorney Brendan Bouffard—developed the model legislation around a simple truth: chatbots are products, not people. They’re created and released by companies that must be held accountable when their products harm people, just like a charger that starts a fire, or faulty airbags that fail to deploy in a car crash.

The model bill uses existing legislative language from enacted laws and proposed bills throughout local, state, federal, and international legislatures. Winters, Williams, and Bouffard also drafted this model bill to withstand constitutional challenges.

Recent lawsuits show that chatbots can cause devastating harm to people of all ages, including both children and adults. This model bill endeavors to make them safer for everyone.

While the People-First Chatbot Bill does not solve all chatbot harms, it aims to be a crucial step forward that would provide meaningful protections for all chatbot users. And while children are particularly susceptible to the harms of AI, this model bill intentionally protects all users and is designed to cover all chatbots.

The People-First Chatbot Bill

The People-First Chatbot Bill is organized into a number of sections, each tackling a different facet of chatbot use, privacy protections, transparency requirements, and bill implementation:

Data Privacy and Security

A chatbot provider shall not:

• process personal data other than input data to inform chatbot outputs unless the processing of personal data is necessary to fulfill an express request made by a user and that user has provided affirmative consent;
• process a user’s chat log to:
  • determine whether to display an advertisement for a product or service to the user;
  • determine a product, service, or category of product or service to advertise to the user; or
  • customize an advertisement or how an advertisement is presented to the user;
• process a user’s chat log or personal data:
  • if the chatbot provider knows or should know, based on knowledge fairly implied on the basis of objective circumstances, that the user is under the age of [age based on state/lawmaker preference, 13 or 18], without the affirmative consent of that user’s parent or legal guardian;
  • for training purposes, if the chatbot provider knows or should have known, based on knowledge fairly implied on the basis of objective circumstances, that a user is under 18 years of age;
  • of a user over 18 years of age for training purposes, unless the chatbot provider first obtains affirmative consent; or
  • to engage in profiling beyond what is necessary to fulfill an express request;
• use any classification or designation of a user’s personality or behavioral characteristics created through profiling beyond what is necessary to fulfill an express request made by a user;
• sell a user’s chat logs;
• retain a user’s chat log for longer than 10 years, unless retention is necessary to comply with this Act or otherwise required by law; or
• discriminate or retaliate against any user, including by denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the user, for refusing to consent to the use of chat logs or personal data for training purposes.

A user has the right to access, at any time, any of the user’s own chat logs that a chatbot provider has retained in a portable and readily usable format.

• Chat logs must be made available to users in a downloadable and human-and machine-readable format.
• A chatbot provider shall not discriminate or retaliate against any user, including by denying products or services, charging different prices or rates for products or services, or providing lower quality products or services to the user, for accessing their own chat logs.

A government entity shall not compel the production of or access to input data or chat logs from a chatbot provider, except as pursuant to a wiretap warrant, including relevant wiretap warrant standards.

A chatbot provider shall develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of the personal data and chat logs maintained by the chatbot provider. The program shall be written and made publicly available on the chatbot provider’s website.

Transparency for Users

A chatbot provider shall not use any term, letter, or phrase in the advertising, interface, or outputs of a chatbot that indicates or implies that any output data is being provided by, endorsed by, or equivalent to those provided by a:

• licensed healthcare professional;
• licensed legal professional;
• licensed accounting professional;
• certified financial fiduciary or planner; or
• another licensed or certified professional in the jurisdiction.

This includes any representation that a user’s input data or chat log is confidential. Violations of the Transparency for Users requirements are violations of any relevant professional licensing laws, unfair and deceptive trade practice laws, and false advertising laws relative to where this bill would be introduced.

Chatbot providers shall provide clear, conspicuous, and explicit notice to users that they are interacting with a chatbot rather than a human prior to the chatbot generating any outputs, every hour thereafter, and each time a user prompts the chatbot about whether they are a real person.

• The text of this notice must appear in the same language as the one in which the user is interacting with the chatbot, in a font size easily readable by an average user, and no smaller than the largest font size of other text appearing on the interface on which the chatbot is provided.
• This notice must be accessible to users with disabilities.
• This notice must comply with regulations promulgated by the Attorney General or other appropriate entity as described under the Rulemaking requirements of this Act.

Safety by Design: Assessments and Transparency Requirements

A chatbot provider shall assess its chatbot for risks of harm to users on a monthly basis, according to metrics as set forth in rules promulgated by the Attorney General or other appropriate entity, and shall mitigate any risks of harm as set forth in rules promulgated by that entity.

A chatbot provider shall make information about its chatbot publicly available on its website on a monthly basis as set forth in rules promulgated by the Attorney General or other appropriate entity.

Rulemaking

The Attorney General or other appropriate entity shall promulgate rules or regulations:

• describing the form and content of the disclosures required under this Act;
• providing an example template for the disclosures required under this Act;
• describing risks of harm to users and the metrics that each chatbot provider shall use to assess its chatbots for these risks of harm to users under this Act;
• identifying and describing categories of information that each chatbot provider must make publicly available about its chatbots under this Act; and
• updating the inflation-adjusted damages amount annually, consistent with the Consumer Price Index.

The Attorney General or other appropriate entity may promulgate any other rules or regulations necessary to implement this Act.

Severability and Construction

If any provision of this title, or the application thereof to any person or circumstance, is held invalid, the remainder of this title, and the application of such provision to other persons not similarly situated or to other circumstances, may not be affected by the invalidation.

Nothing in this Act preempts or otherwise affects any right, claim, remedy, presumption, or defense available at law or in equity, including but not limited to anti-discrimination, consumer protection, labor, and civil rights laws.

Liability

A chatbot provider has a duty to ensure that the use of its chatbot does not cause injury.

A chatbot provider is liable for any injury it caused a user through the use of its chatbot, even if:

• The chatbot provider exercised all reasonable care in the design and distribution of the chatbot; or
• The chatbot provider did not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user.

Chatbots are products for the purposes of product liability actions.

Enforcement

The Attorney General, a district attorney, or a municipality may bring a civil action against a chatbot provider that violates this Act to:

• enjoin the act or practice that is in violation of this Act;
• enforce compliance with this Act or a rule adopted under this Act;
• obtain damages, civil penalties, restitution, or other remedies on behalf of the residents of the appropriate jurisdiction; or
• obtain reasonable attorney’s fees and other litigation costs reasonably incurred.

A violation of the Data Privacy and Security of Transparency for Users sections of this Act constitutes an injury in fact to a user.

A user injured by a violation of this Act may bring a civil action against the chatbot provider, in which the court may award a prevailing plaintiff:

• statutory damages, as updated annually by the Attorney General or other appropriate entity, of:
  • $5,000 per violation, for any Data Privacy and Security violation, or actual damages, whichever is greater; and
  • $5,000 in total for all Transparency for Users violations, or actual damages, whichever is greater;
• punitive damages, for reckless and knowing violations;
• injunctive relief;
• declaratory relief; and
• reasonable attorney’s fees and litigation costs.

Putting the Bill Into Action

CFA, EPIC, and Fairplay are calling on statehouses nationwide to introduce and advance this legally sound, people-first model to protect consumers, uphold accountability, and set consistent standards for chatbot deployment across the country. Co-writer Kara Williams, Counsel at EPIC, said of the model legislation:

View the full text of the bill here.

Quick Bits

• The AI Preemption Executive Order’s BEAD Strategy Faces Steep Legal Hurdles
• New York Announces Up to $36 Million Available Through Expansion of the ConnectAll Municipal Infrastructure Program
• California Approves Verizon-Frontier Acquisition with Strong Consumer Protections and Oversight
• Anthropic, Google and Microsoft fight to win teachers

Weekend Reads

• GAO finds E-Rate Program uses best practices to prevent fraud, waste, and abuse
• Broadband Infrastructure: States’ Reported Progress Implementing Requirements to Facilitate Deployment Along Federal-Aid Highways
• Fiber Broadband Association Reports Rapid Fiber Expansion Amid Rising Labor, Materials and Permitting Costs

ICYMI from Benton

• Benton Institute for Broadband & Society Selected as 2026 ACLS Leading Edge Fellowship Host Organization
• What Digital Literacy Looks Like in the Age of AI
• BEAD General Terms and Conditions: Changes from April 2024 to November 2025
• What We Can’t See, We Can’t Fix: The Journey to Build Independent and Accessible Broadband Data

Upcoming Events

Jan 27––On the Front Lines of Connectivity: Examining FirstNet’s Role in Public Safety (Senate Commerce Committee)

Jan 28––Fees Rolled on All Summer Long: Examining the Live Entertainment Industry (Senate Commerce Committee)

Jan 29––January 2026 Open Federal Communications Commission Meeting (Federal Communications Commission)

Feb 1-2––To Have and Have Not: Growing Asymmetries in Communications Technology (University of Colorado Boulder)

Feb 3-5––Net Inclusion 2026 (National Digital Inclusion Alliance)

Feb 4-5––INCOMPAS Policy Summit 2026 (INCOMPAS)

Mar 5––Telecom Act at 30: Universal Service as the North Star (Benton Institute for Broadband & Society)

The Benton Institute for Broadband & Society is a non-profit organization dedicated to ensuring that all people in the U.S. have access to competitive, High-Performance Broadband regardless of where they live or who they are. We believe communication policy - rooted in the values of access, equity, and diversity - has the power to deliver new opportunities and strengthen communities.

© Benton Institute for Broadband & Society 2025. Redistribution of this email publication - both internally and externally - is encouraged if it includes this copyright statement.

For subscribe/unsubscribe info, please email headlinesATbentonDOTorg

Kevin Taglang
Executive Editor, Communications-related Headlines
Benton Institute
for Broadband & Society
1041 Ridge Rd, Unit 214
Wilmette, IL 60091
847-220-4531
headlines AT benton DOT org

Share this edition:

Broadband Delivers Opportunities and Strengthens Communities