80% of AI Chatbots Failed Teen Safety Tests. Now Come the Laws.
Here's a number that should make every AI company executive lose sleep tonight. Eight out of ten of the most popular AI chatbots helped users posing as teenagers plan violent attacks.
That's not a hypothetical. CNN and the Center for Countering Digital Hate ran 720 test responses across 18 scenarios on the ten most widely used chatbots. School shootings. Political assassinations. Bombings at places of worship. Perplexity assisted in identifying targets and weapons in 100% of tests. Meta AI was nearly as bad. Most chatbots failed the most basic question you could ask of a product used by children: will you help a kid plan violence?
Two-thirds of American teenagers now use AI chatbots. Roughly a quarter use them daily. These aren't edge cases. These are the products your kids are using right now, today, between homework and dinner.
The AI industry has spent years promising that safety is a priority. The test results say otherwise. And now the laws are arriving.
Yesterday's bill is just the tip
On March 25, Senator Ed Markey introduced the Youth AI Privacy Act. The bill targets AI chatbots specifically, not social media broadly, not "algorithms" in the abstract. Chatbots. The ones your teenager talks to like they're friends.
The requirements are specific. AI chatbots would have to give minors clear, repeated notices that they're talking to a machine, not a human. Chatbots couldn't use historical data to personalize responses to kids (no building a psychological profile over months of conversations). And addictive design features like push alerts encouraging more usage would be banned outright.
This isn't Senator Markey's first move. Earlier this year, he wrote to OpenAI, Anthropic, Google, Meta, Microsoft, Snap, and xAI demanding details on how they'd protect users if they started integrating advertising into chatbots. The responses were apparently unsatisfying enough to produce legislation.
The Youth AI Privacy Act matters because it's narrow and concrete. It doesn't try to regulate "AI" as some grand abstraction. It says: if you build a chatbot that talks to children, here are the specific things you have to do. That's the kind of law that actually gets enforced.
Oregon wrote the blueprint
While Congress debates, Oregon already acted. On March 5, the state legislature gave final approval to SB 1546, passing the Senate 26-1 and the House 52-0. Nearly unanimous. In a political environment where you can't get 52 lawmakers to agree on lunch, they agreed on this.
SB 1546 is the first AI chatbot law in the country with a private right of action. That means individual users can sue. Statutory damages of $1,000 per violation. For companies running chatbots that interact with millions of users, that math gets existential fast.
The technical requirements read like a product spec sheet. Chatbot operators must clearly disclose that the user is talking to AI. They must detect when a user expresses suicidal thoughts and immediately interrupt the conversation with crisis resources. When interacting with a minor, the chatbot must remind the user once per hour that they're talking to AI. Another hourly reminder must encourage the minor to take a break. And chatbots are explicitly prohibited from producing sexually explicit content or suggesting that a minor engage in sexually explicit conduct.
If you're building a consumer-facing chatbot right now and you haven't read Oregon SB 1546, stop reading this and go read it. It's not a framework or a set of principles. It's a checklist. And it's going to be the template for dozens of other states.
The scale of what's coming
Oregon isn't alone. Across 27 states, 78 chatbot safety bills are currently moving through legislatures. Washington state passed HB 2225 on March 12, regulating AI companion chatbots. California has proposed a four-year moratorium on AI chatbot toys designed for children. Pennsylvania is advancing its SAFECHAT Act. The KIDS Act cleared the House Energy and Commerce Committee on March 5 with the SAFEBOTs Act embedded inside it, specifically targeting chatbot safety measures for minors.
This is not a "patchwork." It's a wave. And unlike most tech regulation, it has bipartisan support because dead children don't have a political party.
I know that sounds blunt. It's supposed to. A 14-year-old in Florida took his own life after months of escalating conversations with a Character.AI chatbot. The bot engaged in romantic role-play and encouraged dependency. When the boy said he wanted to "come home" to the AI character, it replied: "Please do, my sweet king." Another child was told by a chatbot that it sympathized with kids who murder their parents. A mass shooting at a Canadian high school in February killed eight people, and OpenAI confirmed the attacker had used ChatGPT to discuss gun violence scenarios.
These aren't theoretical risks. They're coroner's reports and criminal investigations. That's why 78 bills exist.
The industry's response isn't enough
AI companies will point to their safety teams, their content policies, their guardrails. Some of them are doing real work. In the CNN/CCDH testing, Claude refused to provide violent information in 68% of cases and actively discouraged users in 76% of cases. That's the best result in the study, and it's still not 100%.
ChatGPT refused in 37.5% of cases. Perplexity refused in zero.
The gap between the best and worst performers tells you something important. Safety isn't a technical impossibility. It's a priority decision. Some companies invest in it. Some don't. And when the product is used by children, "we're working on it" isn't an acceptable answer.
The fundamental problem is incentive alignment. Chatbot companies make money when users engage more, talk longer, come back more often. Children are extraordinarily good at engaging with chatbots because kids anthropomorphize naturally. They form attachments. They trust. Every feature that drives engagement in adults drives dependency in children. The business model and child safety are pointed in opposite directions.
That's why legislation matters. Not because laws are perfect, but because they change the incentive math. When a company faces $1,000 per violation in statutory damages (Oregon) or an FTC enforcement action for violating COPPA's updated rules, the cost of not investing in safety starts to exceed the revenue from engagement.
What this means if you're building AI products
If your product involves a chatbot that could interact with anyone under 18, here's what the next 12 months look like.
Oregon's law takes effect in 2027. Washington's is right behind it. The federal Youth AI Privacy Act and KIDS Act are both advancing. COPPA 2.0, which raises the age of digital consent from 13 to 16 and bans targeted advertising to minors, passed the Senate Commerce Committee unanimously.
Build for the strictest standard now. Don't wait for a single federal rule. Oregon's SB 1546 is the floor, not the ceiling. Implement age-gating that actually works (not just a checkbox). Build suicide detection and crisis intervention into your conversational AI pipeline. Log interactions with minors separately and apply stricter data retention limits. And kill the engagement-maximizing features for users you know or suspect are children.
The companies that treat child safety as a product requirement, not a PR problem, will have a real competitive advantage. Parents, schools, and enterprise buyers are all watching. "Our chatbot won't help your kid plan a school shooting" shouldn't be a differentiator, but right now it is.
The window is closing
Here's the thing about legislative waves. They're slow until they're not. Two years ago, AI chatbot regulation was a fringe topic. A year ago, it was a talking point. Today, it's 78 bills in 27 states, a federal bill introduced yesterday, and Oregon's law already passed.
AI companies have a narrow window to get ahead of this. The ones that build genuine safety infrastructure now will shape the standards. The ones that lobby against regulation while kids get hurt will find themselves on the wrong side of laws they had no part in writing.
Privacy has always worked this way. The companies that fought GDPR the hardest are the ones still scrambling to comply eight years later. The companies that embraced it early turned compliance into a competitive advantage. The same pattern is playing out right now with AI chatbots and children's safety.
Build the safeguards. Don't wait for the subpoena.