H5138, the “Chatbot Protection Act,” creates a new Chapter 80 in Title 39 of the South Carolina Code to regulate chatbot providers, including AI systems that simulate conversation through text, audio, image, or video. The bill defines key terms such as chatbot, chatbot provider, chat log, personal data, training, profiling, dark pattern, and affirmative consent, and it sets detailed standards for how providers may collect, use, retain, and disclose user data. It generally prohibits using personal data to generate chatbot outputs without express user request and affirmative consent, using chat logs for advertising decisions, selling chat logs, profiling users beyond what is necessary for an express request, and retaining chat logs longer than ten years unless otherwise required by law.
The bill also requires chatbot providers to give users access to their own chat logs in a downloadable, readable format, maintain a written data security program, and take steps to prevent deidentified data from being reidentified. It bars providers from implying that chatbot output is endorsed by licensed professionals or that user chats are confidential, and it requires clear notice that a user is interacting with a chatbot rather than a natural person. Providers must also evaluate their systems monthly for potential user harm, publicly disclose certain information about the chatbot, and mitigate identified risks. The Attorney General is given rulemaking authority to implement the chapter and to define notice and risk-mitigation requirements.
The bill’s legal impact is significant because it treats a chatbot as a product for product liability purposes and creates a duty for providers to ensure chatbot use does not injure users. It authorizes civil enforcement by the Attorney General or a county attorney, and it also creates a private right of action for users injured by violations of the data-use and disclosure provisions. Available remedies include injunctions, damages, restitution, civil penalties of up to $5,000 per violation, punitive damages for reckless or knowing conduct, and attorney’s fees. The bill would therefore add both regulatory compliance obligations and litigation exposure for chatbot developers, distributors, and other providers operating in South Carolina.
The overall sentiment reflected in the bill text is precautionary and consumer-protective, emphasizing privacy, transparency, safety, and limits on commercial exploitation of user interactions. Because there are no committee transcripts or recorded votes provided, there is no direct evidence of legislative support or opposition in the available context. The bill appears designed to address concerns about AI deception, data harvesting, minor protection, and the use of chatbot conversations for advertising or training without meaningful consent.
The main points of contention likely concern the breadth of the restrictions and the compliance burden on AI companies. Potentially disputed issues include the requirement for affirmative consent before training on adult user data, the ban on using chat logs for advertising, the ten-year retention limit, the obligation to provide chat logs on request, and the product-liability treatment of chatbots. Industry stakeholders may view these provisions as expansive and costly, while privacy advocates and consumer protection interests would likely support them as necessary safeguards.
The bill would add a new chapter to Title 39 governing chatbot providers and would impose state-law duties on data processing, disclosure, security, retention, and user access. It would create new enforcement authority for the Attorney General and county attorneys, establish a private right of action for certain violations, and make chatbots subject to product-liability principles. The measure would directly affect AI and chatbot companies, platform operators, and any business that creates, distributes, or makes a chatbot available to users in South Carolina.
The bill’s tone is strongly protective of consumers and users, especially with respect to privacy, transparency, and harm prevention in AI systems. No committee debate or vote record is available in the provided materials, so there is no documented bipartisan or partisan split to report. Based on the text alone, the measure appears to be framed as a response to perceived risks from AI chatbots rather than as a deregulatory or industry-friendly proposal.
Likely areas of contention include whether the bill overregulates AI products, whether affirmative consent should be required for adult training data, and whether chat logs should be barred from advertising uses and subject to a ten-year retention cap. The product-liability provision and private right of action may also draw opposition from providers concerned about expanded litigation exposure. Supporters would likely emphasize user privacy, minor protections, anti-deception rules, and the need for transparency when users interact with automated systems.