CAW Registry

No obligations extracted for this instrument.

Scope

• applies_to_operator = named_respondents_only_Alphabet_CharacterTechnologies_Instagram_MetaPlatforms_OpenAIOpCo_Snap_XAI

  The Commission "voted 3-0 to issue the 6(b) orders to the seven companies." The recipients "include: Alphabet, Inc.; Character Technologies, Inc.; Instagram, LLC; Meta Platforms, Inc.; OpenAI OpCo, LLC; Snap, Inc.; and X.AI Corp." This is a 6(b) study directed at seven named companies, not a generally applicable rule; no obligation rows are recorded because it imposes no duty on operators generally. Correction: the prior quote dropped "the 6(b)" and "and" -- fixed this session to match the primary exactly.

Verified by CAW editor (seed review) on 2026-09-08T00:00:00Z

Archived copy: 790f50ad44b3… (retrieved 2026-11-04). Last checked 2026-11-04.

Live primary source: https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions

Obligations

• blocking data_use: A covered entity or business associate may not use or disclose protected health information except as permitted or required by the Privacy Rule.

  "A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter" (45 C.F.R. §164.502(a)).

Scope

• applies_to_operator = covered_entity; business_associate

  "Covered entity," "health care provider," and "health plan" are each defined at 45 C.F.R. §160.103; state chatbot statutes (e.g., Utah 13-72a-101(4),(7),(8)) borrow these definitions directly.

• covered_service = protected_health_information

  The Privacy Rule (45 C.F.R. Part 164, Subpart E) governs "protected health information" held by a covered entity or business associate.

Verified by CAW editor (seed review) on 2026-09-08T00:00:00Z

Archived copy: b743ebde81b4… (retrieved 2026-10-06). Last checked 2026-11-04.

Live primary source: https://www.law.cornell.edu/cfr/text/45/164.502

Obligations

• blocking age_assurance: An operator of a service directed to children under 13, or with actual knowledge it is collecting personal information from a child under 13, must obtain verifiable parental consent before collecting, using, or disclosing that information.

  FTC regulations must require operators to "obtain verifiable parental consent for the collection, use, or disclosure of personal information from children" (15 U.S.C. §6502(b)(1)(A)(ii)).

• material data_use: An operator may not condition a child's participation in an activity on the child disclosing more personal information than is reasonably necessary.

  Regulations must "prohibit conditioning a child's participation ... on the child disclosing more personal information than is reasonably necessary" (15 U.S.C. §6502(b)(1)(C)).

Scope

• applies_to_operator = operator_of_website_or_online_service_directed_to_children_or_with_actual_knowledge

  15 U.S.C. §6501-6502.

• covered_user_min_age = 13

  "The term 'child' means an individual under the age of 13" (15 U.S.C. §6501(1)); it is unlawful for "an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child" without complying with the Rule's requirements (15 U.S.C. §6502(a)(1)). Correction: the prior quote combined language from both sections that does not appear together verbatim; replaced this session with the two real definitional/operative quotes.

Verified by CAW editor (seed review) on 2026-09-08T00:00:00Z

Archived copy: c38ceafbe042… (retrieved 2026-10-06). Last checked 2026-11-04.

Live primary source: https://www.law.cornell.edu/uscode/text/15/6502