EveryAILaw.comDoes Georgia AI Companion Chatbot Safeguards (SB 540) require Data Governance?
Georgia • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 6 specific requirements for Data Governance across 1 provision:
- Risk-proportionate age assurance — Before allowing access to a feature or mode that may generate synthetic content containing sexually explicit conduct, use a commercially reasonable age assurance method proportionate to the risk of the feature, which may include age estimation, account-based assurance, or identity-based verification where necessary (§ 39-5-6(j))
- Privacy safeguards for the method — Assure that the age assurance method implements data privacy policies sufficient to reasonably ensure protection of identifiable data (§ 39-5-6(j))
- Data minimization — Minimize collection and retention of personal information used for age assurance (§ 39-5-6(j))
- Identity document retention — Do not retain identity documents longer than reasonably necessary to complete age assurance unless otherwise required by law (§ 39-5-6(j))
- No sale, single purpose — Do not sell any data collected for age assurance purposes, and use it for no purpose other than age verification (§ 39-5-6(j))
- 24-hour retention ceiling — Do not retain such data longer than 24 hours, or another specified time if permitted by law, whichever is longer (§ 39-5-6(j))
Age Assurance and Age-Data Handling #
This is not a general age-verification mandate, despite how the Act is often summarized. The trigger is narrow — access to a feature or mode that may generate sexually explicit synthetic content — and the method is risk-proportionate, so age estimation or account-based assurance can satisfy it where identity verification is not necessary. The binding weight sits in the data rules that follow: minimize collection, no sale, single-purpose use, and a 24-hour retention ceiling for age-assurance data unless a longer period is permitted by law.
Requirements
| Requirement | Details |
|---|---|
| Risk-proportionate age assurance | Before allowing access to a feature or mode that may generate synthetic content containing sexually explicit conduct, use a commercially reasonable age assurance method proportionate to the risk of the feature, which may include age estimation, account-based assurance, or identity-based verification where necessary (§ 39-5-6(j)) |
| Privacy safeguards for the method | Assure that the age assurance method implements data privacy policies sufficient to reasonably ensure protection of identifiable data (§ 39-5-6(j)) |
| Data minimization | Minimize collection and retention of personal information used for age assurance (§ 39-5-6(j)) |
| Identity document retention | Do not retain identity documents longer than reasonably necessary to complete age assurance unless otherwise required by law (§ 39-5-6(j)) |
| No sale, single purpose | Do not sell any data collected for age assurance purposes, and use it for no purpose other than age verification (§ 39-5-6(j)) |
| 24-hour retention ceiling | Do not retain such data longer than 24 hours, or another specified time if permitted by law, whichever is longer (§ 39-5-6(j)) |
Penalties
| Violation | Fine |
|---|---|
| Attorney General civil action | Up to $10,000 per knowing violation plus compensatory damages, costs and fees, and injunctive relief (§ 39-5-6(k)(1)) |
| Per-day, per-user accrual | Each day in violation is a separate violation for each user affected (§ 39-5-6(k)(2)) |