The US Senate Commerce Committee voted unanimously on August 5, 2026 to advance the CHATBOT Act (S. 4407), a bill from Sens. Ted Cruz, Brian Schatz, John Curtis and Adam Schiff that would force AI chatbot providers to build mandatory "family accounts" — giving parents a full record of a teenager's conversations and an alert whenever the minor tries to disable monitoring. The bill cleared committee as part of a broader kids'-safety package that also advanced the Kids Online Safety Act, and now heads to the Senate floor.
The most consequential design choice in the bill has nothing to do with chatbots specifically: it applies one consent regime to every user under 18, collapsing the difference between an 8-year-old and a 17-year-old into a single mandatory-surveillance default. As the Electronic Frontier Foundation put it in its analysis of the bill, Congress is proposing to "extend the COPPA parental-permission model to millions of older teenagers," stretching a framework built for children 12 and under — the US Children's Online Privacy Protection Act's actual threshold — across the entire span of adolescence.
India already ran this experiment
India's Digital Personal Data Protection Act, 2023 made exactly this choice two years ago. As PRS Legislative Research's bill-track summary notes, the DPDP Act defines a "child" as any person below 18 — deliberately broader than COPPA's 13, the UK and EU's 16, or most comparable regimes — and requires verifiable parental consent before any data fiduciary can process that child's personal data, with no gradation for a 17-year-old preparing for board exams versus a 9-year-old on a homework app. The Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology, operationalise this through Rule 10: consent must be verified either against identity records the platform already holds or through a "virtual token" issued by an authorised entity, with DigiLocker as the anchor credentialing system.
That framework is not yet fully live. Most of Rule 10's substantive obligations — verifiable parental consent among them — phase in on a staggered timeline and become enforceable on May 14, 2027, eighteen months after the November 2025 notification, giving platforms a runway most American companies won't get if the CHATBOT Act moves at its current pace.
Steelmanning the bill
The case for the CHATBOT Act is not frivolous. Companion-chatbot products are explicitly engineered to sustain engagement through personalized, emotionally responsive dialogue, and UNICEF's 2026 guidance on AI and children flags exactly this: harm from these products is "diffuse, cumulative, and built into the product's design incentive," not a single bad interaction a filter can catch. A parent who has no visibility into whether their child is confiding self-harm ideation to a chatbot at 2 a.m. has a legitimate grievance that platform terms-of-service disclaimers do not resolve. Family-access tools, offered as an option, are a reasonable response to that gap.
The defect is not the existence of monitoring tools — it's making them mandatory and identical for every minor. A livelaw.in analysis of India's approach makes the sharper point: consent-at-signup models assume harm arrives at a single threshold moment, when in reality chatbot risk accumulates gradually through months of engagement that no one-time parental checkbox — however "verifiable" — is built to track. Both the DPDP Act and the CHATBOT Act's mandatory-alert regime substitute a compliance ritual for that continuous problem, while imposing real costs: platforms must build persistent identity-verification and surveillance infrastructure for tens of millions of users who present no ascertainable risk, and a 17-year-old researching a sensitive medical or family question loses exactly the confidentiality that makes them ask an AI in the first place rather than a parent.
Two governments, one flawed instinct
What should concern a pro-innovation reader in India specifically is not that Washington is copying Delhi's mistake — it's that neither capital has yet corrected it. India has the more defensible excuse: the DPDP Act predates the current wave of companion-chatbot products, and its child-consent provisions were built for e-commerce and social media data collection, not conversational AI. The livelaw.in piece is right that India's regulatory architecture assigns accountability to platforms that "host" content, leaving the design responsibility of chatbot developers — who generate the content, not merely host it — legally undefined. The CHATBOT Act has no such excuse: it is being written in 2026, with the companion-chatbot harm pattern already documented, and it still reaches for the blanket-age-threshold tool instead of a tiered one.
The fix, on both sides of the Pacific, is the same: replace the single under-18 bright line with graduated obligations — stronger defaults and mandatory parental visibility for pre-teens, opt-in (not opt-out) monitoring for older teens, and design-level accountability for engagement-maximizing chatbot behavior regardless of the user's age. India's Rule 10 verification infrastructure, built on DigiLocker, is actually a more sophisticated technical foundation than anything the CHATBOT Act proposes — it could support age-tiered consent without new legislation, if MeitY's child-safety working group chooses to write the gradation in when it finalises pending recommendations. Washington, still at the committee stage, has the chance to build it in from the start rather than retrofit it after a court challenge. Neither government should mistake a parental dashboard for a safety standard.