HR 9619
To require artificial intelligence chatbot providers to provide data privacy and security, and for other purposes.
TL;DR
Rep. Valerie Foushee (D-NC) introduced this bill to require AI chatbot providers (think ChatGPT, Claude, Gemini, and customer service bots) to protect user data and follow specific privacy and security rules. It targets how chatbots collect, store, and use consumer information during conversations.
How This Might Impact Your Business
Companies deploying AI chatbots for customer service, sales, or support would face new federal data privacy and security obligations on top of existing state laws like CCPA
Chatbot providers (OpenAI, Anthropic, Google, Microsoft, and smaller vendors) would need to implement specific safeguards for conversation data
Businesses using third-party chatbot APIs or white-label solutions may need to renegotiate vendor contracts to ensure compliance flows through
Consumer-facing industries relying on chatbots (retail, banking, healthcare, telecom) would likely need updated privacy disclosures and consent flows
Bill is early stage (just referred to House Energy and Commerce Committee), so specific requirements, penalties, and timelines are not yet finalized in public detail
No size threshold or small business exemption has been publicly detailed, meaning startups deploying chatbots could face the same obligations as enterprises
Federal preemption unclear, companies may need to comply with both this and existing state AI and privacy laws
What Should You Do
Inventory every chatbot touchpoint in your business (customer support, internal HR bots, sales assistants) and document what user data each one collects and stores
Ask your legal and procurement teams to review chatbot vendor contracts for data handling, breach notification, and indemnification clauses
Have your privacy officer benchmark current chatbot disclosures against stricter standards like the EU AI Act to prepare for likely federal alignment
Assign someone to track HR 9619 through the House Energy and Commerce Committee and flag when markup or hearings are scheduled
Brief your CX and product teams that chatbot data retention policies may need shortening in the next 12 to 24 months
Who It Affects
Sponsors
Status Timeline
committee
Referred to the House Committee on Energy and Commerce.
July 9, 2026