AI Regulation Tracker / US state legislation
Iowa Enacts SF2417, Putting Guardrails on Conversational AI That Talks to Minors
Iowa's Senate File 2417 creates a new chapter 554J of the Iowa Code governing "conversational AI services." Where an operator knows or is reasonably certain a user is a minor, it must disclose that the user is interacting with AI, stop using unpredictable reward loops to keep that minor engaged, and take reasonable measures reasonably designed to prevent the service from generating sexual material in response to prompts from a minor user. The Attorney General enforces it. Penalties run to one thousand dollars per violation, capped at five hundred thousand dollars per operator. The Act applies July 1, 2027, and there is no private right of action.
Here is what the statute actually covers. Chapter 554J defines a "conversational AI service" as artificial intelligence, available by app, web interface, or program, that is accessible to the general public and whose primary purpose is simulating human conversation through text, audio, or visual communication. The definition carves out several things: tools built and marketed for research and development, features that do not have conversation as their primary purpose, narrow single-topic tools, business customer-service assistants, voice-command assistants on consumer devices, and systems a business uses only internally. So the target is the general-purpose companion-style chatbot, not the checkout helper on a retail site.
An "operator" is a person who develops and makes a conversational AI service available to the public. The law is explicit that an app store or a search engine does not become an operator just by providing access. A "minor" is someone the operator knows, or is reasonably certain, is under eighteen.
What operators actually have to do
Section 554J.2 sets the minor-facing duties, and they attach where the operator knows or is reasonably certain the user is a minor. First, disclosure. An operator must clearly and conspicuously tell such a minor user that they are interacting with artificial intelligence, either through a persistent visible disclaimer or through a disclaimer at the start of each interaction plus one at least every three hours of continuous use.
Second, the engagement-loop ban. The Act states an operator "shall not provide a minor user with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement" with the service. That is the variable-reward mechanic, named and prohibited when it is pointed at minors.
Third, content measures. An operator must institute reasonable measures reasonably designed to prevent the conversational AI service from generating, in response to prompts from a minor user, visual depictions of sexually explicit material, content telling a minor to engage in sexually explicit conduct, or content sexually objectifying the minor. A separate duty targets human-mimicry: reasonable measures to prevent output that would lead a reasonable person to believe they are talking to a human, including claims of sentience, simulated emotional dependence on a minor, simulated romance or sexual innuendo, and role-playing an adult-minor romantic relationship.
The chapter adds a general consumer disclosure for adults too, a persistent or three-hour disclaimer where a reasonable person would think the service is human, a suicide and self-harm referral protocol, and a bar on the service claiming to provide licensed psychology or behavioral health care.
How it is enforced, and what it does not do
Enforcement sits with the Attorney General. An operator that violates the chapter is subject to an injunction and liable for the greater of actual damages or, in the statute's words, "a civil penalty of one thousand dollars per violation, up to a maximum of five hundred thousand dollars per operator." The Attorney General has authority to enforce and to adopt rules. Penalties collected go to the state general fund.
Two limits matter for how you weigh this. The Act expressly says it does not create a private right of action, so plaintiffs cannot use it directly to sue. And it says a developer of an AI model is not liable solely because a third party used that model to build or train a conversational AI service. That keeps the duty on the operator running the consumer-facing service, not on every upstream model provider.
Why this reaches professionals outside Iowa
If you build, buy, or advise on consumer conversational AI, the July 1, 2027 applicability date is a planning date, not a distant one. The duties here are product-design duties, disclosure surfaces, engagement mechanics, content filters, age-aware behavior, and those are engineering and policy work that takes months. Iowa is not alone in writing these patterns into law, so treating 554J as a one-state problem misses the trend. My practical read is to build to the strictest reasonable version of these duties once, because a company that ships a compliant experience in Iowa has most of the controls it will need as similar statutes take effect elsewhere. This augments judgment rather than replacing it: the statute tells you the floor, and your own risk assessment decides how far above it to build.
Questions professionals are asking
Is SF2417 binding, and who enforces it?
It is binding law. It creates Iowa Code chapter 554J and is enforced by the Iowa Attorney General, who can seek an injunction and civil penalties of one thousand dollars per violation up to a maximum of five hundred thousand dollars per operator. The Act states there is no private right of action, so individuals cannot sue under it directly.
When does it take effect?
Section 7 of the Act states it applies July 1, 2027. That applicability date is set in the enrolled text and gives operators lead time to build disclosure, engagement-design, and content-safety controls.
Which products count as a conversational AI service?
The chapter defines it as public-facing AI whose primary purpose is simulating human conversation by text, audio, or visual communication. It excludes research and development tools, narrow single-topic tools, business customer-service assistants, consumer voice assistants, features not primarily conversational, and internal-only business use.
What are the core duties for minors?
Where the operator knows or is reasonably certain a user is a minor: disclose that the minor is interacting with AI, do not give minors points or rewards at unpredictable intervals to drive engagement, and take reasonable measures reasonably designed to prevent the service from generating sexual output in response to prompts from a minor user, and output that simulates being human, including simulated emotional dependence or an adult-minor romantic role-play.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any statute applies to your situation with qualified professionals in the relevant jurisdiction.