New Legal Guide Outlines How Existing Laws Protect Children from AI Chatbot Harms; Addresses Data Retention and Confidentiality Risks**

The Electronic Privacy Information Center (EPIC) and a coalition of privacy experts and former FTC enforcers released a comprehensive guide on Novemb...

Published November 2025 • Feature

# New Legal Guide Outlines How Existing Laws Protect Children from AI Chatbot Harms; Addresses Data Retention and Confidentiality Risks** The Electronic Privacy Information Center (EPIC) and a coalition of privacy experts and former FTC enforcers released a comprehensive guide on November 10, 2025, explaining how existing U.S. federal and state laws apply to AI chatbot harms affecting children and teens. The guide addresses critical issues including client confidentiality violations (consumer AI platforms may retain queries, exposing privileged communications), national security implications, and professional liability risks for organizations using unsecured AI tools. The guide emphasizes that consumer AI platforms may retain sensitive information indefinitely, creating litigation and compliance exposure. It highlights the necessity of professional-grade AI solutions with FedRAMP compliance, government cloud deployment options, and comprehensive audit capabilities for government and regulated sectors. The timing aligns with broader year-end regulatory activity and state-level privacy law enforcement preparations for 2026. ## Why It Matters This guidance establishes a legal framework for evaluating consumer vs. professional-grade AI tools, particularly for organizations handling sensitive data. Data teams must audit their current LLM usage and implement governance policies restricting use of non-sanctioned AI tools. The guide's emphasis on data retention and re-identification risks strengthens the business case for synthetic data—by working with synthetic datasets, organizations eliminate exposure to many of these risks. Startups building data governance tools or privacy-preserving infrastructure should align with the EPIC guidance framework. Organizations serving K-12 education, healthcare, or government must prioritize air-gapped or private deployment options for AI systems. ## Sources - EPIC / November 10, 2025 [web:48], [web:53]

Source: EPIC