Chatbot Regulation

2025-2026 Bill 5138: Chatbot Regulation - South Carolina Legislature Online

South Carolina General Assembly
126th Session, 2025-2026
Download
This Bill
in Microsoft Word Format
Indicates Matter Stricken
Indicates New Matter
H. 5138
STATUS INFORMATION
General Bill
Sponsors: Reps. Guffey, Sessions, Martin and Brewer
Companion/Similar bill(s): 896
Document Path: LC-0521SA26.docx
Introduced in the House on February 10, 2026
Currently residing in the House Committee on
Labor, Commerce and Industry
Summary: Chatbot Regulation
HISTORY OF LEGISLATIVE ACTIONS

Date

Body

Action Description with journal page number

2/10/2026

House

Introduced and read first time (
House Journal-page 10
)

2/10/2026

House

Referred to Committee on
Labor, Commerce and Industry
(
House Journal-page 10
)

View the latest
legislative information
at the website
VERSIONS OF THIS BILL
02/10/2026

A bill

TO AMEND THE SOUTH CAROLINA CODE OF LAWS SO AS TO ENACT
THE "CHATBOT PROTECTION ACT"; AND BY ADDING CHAPTER 80 TO TITLE 39 SO AS TO
PROVIDE RESTRICTIONS ON CERTAIN CHATBOT ACTIVITIES AND TO PROVIDE FOR CIVIL
ACTIONS.

B
e it enacted by the
General Assembly of the State of South Carolina:

S
ECTION 1.
This act may be cited as the "Chatbot Protection Act."

S
ECTION 2.
T
itle 39 of the S.C. Code is amended by adding:

C
HAPTER 80

C
hatbot Protection

S
ection
39-80-10
.
A
s used in this chapter:

(
1)
(
a) "Advertisement" means any written
or oral statement, illustration, or depiction that is displayed in exchange for
monetary or other valuable consideration if the written or oral statement,
illustration, or depiction:

(
i)
promotes the sale or use of a good or service; or

(
ii)
is designed to increase interest in a brand, good, or service.

(
b)
"Advertisement" includes access to data between the chatbot provider and a
brand, good, or service.

(
2)
(
a) "Affirmative consent" means a clear
affirmative act that signifies a user's freely given information and
unambiguous authorization for an act or practice in response to a specific
request from a chatbot provider, if:

(
i)
The request is provided to the user in a clear and conspicuous stand-alone
disclosure.

(
ii)
The request includes a description that is written in easily understandable
language.

(
iii) The request is made in a manner
that is reasonably accessible and available by users with disabilities.

(
iv)
The request is made available to the user in each language in which the chatbot
provider provides a chatbot.

(
v)
The option to decline consent is at least as prominent as the option to give
consent, and the option to decline consent takes the same or fewer number of
steps as the option to give consent.

(
vi)
Affirmative consent to an act or practice may not be inferred from the inaction
of the user or the user's continued use of a chatbot.

(
b)
"Affirmative consent" does not include:

(
i)
acceptance given by general or broad terms of use;

(
ii)
hovering over, muting, pausing, or closing a given piece of content;

(
iii) an agreement that is obtained
through the use of a false, fraudulent, or materially misleading statement or
representation; or

(
iv)
an agreement that is obtained through the use of other dark patterns.

(
3)
"Chatbot" means an algorithmic or automated system that generates information
through text, audio, image, or video in a manner that simulates interpersonal
interactions or conversations including artificial intelligence.

(
4)
"Chatbot provider" means any person that creates, distributes, or otherwise
makes a chatbot available to a user.

(
5)
"Chat log" means:

(
a)
input data or a record of the input data; and

(
b)
output data that is generated by a chatbot or from interactions with a chatbot.

(
6)
"Dark pattern" means a user interface that is designed or manipulated to
subvert or impair a user's autonomy, decision making, or choice.

(
7)
"Deidentified data" means information that:

(
a)
cannot reasonably be used to infer or derive the identity of a user;

(
b)
does not identify a user; and

(
c)
is not linked or is not reasonably linkable to a user.

(
8)
"Input data" means information including texts, photos, audio files, video
files, and any type of file that is provided to a chatbot by a user.

(
9)
"Model" means an engineered or machine-based system underlying a chatbot that
is based on the input data that it receives and that can infer how to generate
output data that can influence physical or virtual environments.

(
10)
(
a) "Personal data" means:

(
i)
any information, including derived data, that is linked or is reasonably
linkable either by itself or in combination with other information to an
identified or identifiable user; or

(
ii)
a device that identifies or is linked or is reasonably linkable to a user.

(
b)
"Personal data" does not include deidentified data or publicly available
information.

(
11)
(
a) "Publicly available information"
means information that has been lawfully made available to the public subject
to a public records request.

(
b)
"Publicly available information" does not include:

(
i)
obscene items;

(
ii)
biometric data;

(
iii) personal data that is created
through the combination of personal data and publicly available information;

(
iv)
genetic data, unless the genetic data was made available to the public by the
user to whom the genetic data pertains;

(
v)
information that is made available to the public by a user who uses a website
or online platform on which the user has restricted the information to a
specific audience; or

(
vi)
intimate images that are either authentic or computer generated and that are
known to be nonconsensual.

(
12)
"Process" or "processing" means any operation or set of operations that are
performed on personal data or input data including the use, storage,
disclosure, analysis, deletion, or modification of personal data or input data.

(
13)
(
a) "Profiling" means to process
personal data or input data to classify or designate personality traits and
behavioral characteristics of a user.

(
b)
"Profiling" does not include processing chat logs for user safety or to
otherwise comply with this chapter.

(
14)
(
a) "Sell" means:

(
i)
the exchange of personal data or input data for monetary or other valuable
consideration; or

(
ii)
to make personal data or input data available to a third party for monetary or
other valuable consideration.

(
b)
"Sell" does not include:

(
i)
the disclosure of personal data or input data to a third party that processes
the personal data or input data on behalf of the chatbot provider;

(
ii)
the disclosure of personal data or input data where the user provides
affirmative consent and directs the chatbot provider to disclose the personal
data or input data or intentionally uses the chatbot provider to interact with
a third party; or

(
iii) the disclosure of personal data
or input data that the user intentionally made available to the public through
social media and did not restrict the information to a specific audience.

(
15)
(
a) "Training" means the use of input
data to adjust or modify a model.

(
b)
"Training" does not include:

(
i)
tests that are used to identify risk of harm to users;

(
ii)
adjustments or modifications that are made to address identified risk of harm
to users; or

(
iii) any action that is necessary to
comply with this article or as otherwise required by law.

(
16)
"User" means any natural person regardless of age.

S
ection
39-80-20
.
(
A) A chatbot provider
may not:

(
1)
process personal data to inform a chatbot output unless processing personal
data is necessary to fulfill an express request that is made by a user and the
user provides affirmative consent;

(
2)
process a user's chat log:

(
a)
to determine whether to display an advertisement for a product or service to a
user;

(
b)
to determine a product or service or category of a product or service to
advertise to a user; or

(
c)
to customize an advertisement for presentation to a user;

(
3)
process a user's chat log and personal data:

(
a)
if the chatbot provider knows or reasonably should have known that based on
knowledge of objective circumstances the user is a minor and the user's parent
or legal guardian did not provide affirmative consent;

(
b)
for training purposes if the chatbot provider knows or reasonably should have
known that based on knowledge of objective circumstances the user is a minor
and the user's parent or legal guardian did not provide affirmative consent;

(
c)
for training purposes if the user is an adult, unless the chatbot provider
first obtains affirmative consent; or

(
d)
to engage in profiling beyond what is necessary to fulfill an express request;

(
4)
profile a user based on any classification or designation of the user's
personality or behavioral characteristic beyond what is necessary to fulfill an
express request made by the user;

(
5)
sell a user's chat logs;

(
6)
retain a user's chat log for more than ten years, unless retention is necessary
to comply with this chapter or otherwise required by law;

(
7)
discriminate or retaliate against a user, including:

(
a)
denying products or services to the user;

(
b)
charging different prices or rates for products or services to the user; or

(
c)
providing lower quality products or services to the user for refusing to
consent to the use of chat logs or personal data for training purposes.

(
B) A
user has a right to access the user's own chat logs at any time. A chatbot
provider shall provide a user's own chat log on request by the user and shall
provide the chat log in a downloadable and easy to read format. A chatbot
provider may not discriminate or retaliate against a user that requests the
user's chat.

(
C) A
governmental entity may not compel the production of or access to input data or
chat logs from a chatbot provider, except as pursuant to a wiretap warrant.

(
D) A
chatbot provider shall develop, implement, and maintain a comprehensive data
security program that contains administrative, technical, and physical
safeguards that are proportionate to the volume and nature of personal data and
chat logs that are maintained by the chatbot provider. The program must be
written and made publicly available on the chatbot provider's website.

(
E) A
chatbot provider shall take the necessary physical, administrative, and
technical measures to prevent deidentified data from being reidentified and to
process, retain, and transfer deidentified data without any reasonable means of
reidentification.

S
ection
39-80-30
.
(
A) A chatbot provider
may not:

(
1)
use any term, letter, or phrase in the advertising, interface, or output data
of a chatbot that states or implies that the advertising, interface, or output
data of a chatbot is endorsed by or equivalent to any of the following:

(
a)
any certified, registered, or licensed professional;

(
b)
a licensed legal professional;

(
c)
a certified public accountant;

(
d)
an investment advisor or an investment advisor representative; or

(
e)
a licensed fiduciary;

(
2)
include any representation in the advertising, interface, or output data of a
chatbot that states or implies the user's input data or chat log is
confidential.

(
B) A
chatbot provider shall provide clear, conspicuous, and explicit notice to a
user that the user is interacting with a chatbot rather than a natural person
before the chatbot may generate any output data. The chatbot provider shall
include this notice at the beginning of each chatbot communication with a user
every hour thereafter and each time a user asks whether the chatbot is a
natural person. The text of the notice must:

(
1)
be written in the same language that the chatbot communicates with the user and
must appear in a font size that is easily readable by an average user and is
not smaller than the largest font size used for other chatbot communications;
and

(
2)
must comply with the rules adopted and the regulations promulgated by the
Attorney General pursuant to Section
39-80-40
.

(
C) In
compliance with the rules adopted and the regulations promulgated by the
Attorney General pursuant to Section
39-80-40
, a chatbot provider shall:

(
1)
on a monthly basis:

(
a)
evaluate its chatbot for potential risk of harm to users; and

(
b)
make information about its chatbot publicly available on its website; and

(
2)
mitigate any risk of harm to users.

S
ection
39-80-40
.
(
A) The Attorney General
shall adopt rules and promulgate regulations to implement this chapter. The
rules and regulations must:

(
1)
describe the form and content of the notice that is required pursuant to
Section
39-80-30
;

(
2)
provide an example template for the notice that is required pursuant to Section
39-80-30
;

(
3)
describe any potential risk of harm to users; and

(
4)
provide requirements for a chatbot provider to implement to reduce the risk of
harm to users.

(
B)
The Attorney General may adopt any other rules or promulgate regulations
necessary to implement this chapter.

S
ection
39-80-50
.
(
A) A chatbot is
considered a product for the purposes of a product liability action.

(
B) A
chatbot provider has a duty to ensure that the use of the chatbot provider does
not cause injury to a user.

(
C) A
chatbot provider is liable for any injury that the chatbot causes to a user if:

(
1)
the chatbot provider exercised all reasonable care in the design and
distribution of the chatbot; or

(
2)
the chatbot provider did not directly distribute the chatbot to the user or
otherwise enter into a contractual relationship with the user.

S
ection
39-80-60
.
(
A) The Attorney General
or a county attorney may bring a civil action against a chatbot provider that
violates this chapter and that includes any of the following:

(
1)
enjoining an act or practice in violation of this chapter;

(
2)
enforcing compliance with this chapter or a rule adopted or regulation
promulgated pursuant to this chapter;

(
3)
obtaining damages, civil penalties, restitution, or other remedies; or

(
4)
obtaining reasonable attorney's fees and other litigation costs.

(
B) A
violation of Section
39-80-20
or
39-80-30
constitutes an injury in fact to a
user.

(
C) A
user who is injured by a violation of Section
39-80-20
or
39-80-30
may bring a
civil action against the chatbot provider, and a court of competent
jurisdiction may award a prevailing plaintiff any of the following:

(
1)
a civil penalty of not more than five thousand dollars per violation of this
chapter;

(
2)
punitive damages for reckless and knowing conduct;

(
3)
injunctive relief;

(
4)
declaratory relief; or

(
5)
reasonable attorney's fees and litigation costs.

S
ECTION 3. This act takes effect upon approval
by the Governor.

----XX----

This web page was last updated on February 10, 2026 at 1:38 PM