Iowa’s new AI law is a start, but stronger regulations are needed to protect kids

Twenty years ago, social media promised to bring us closer together. While we quickly embraced that technology, only later did we begin to understand its costs, especially for children. We now stand at a similar crossroads with artificial intelligence, but the stakes are even higher.

Tools such as ChatGPT, Claude, Gemini, and Grok are designed to engage in conversations with users and can answer questions, give advice, complete tasks, and even offer emotional support in ways that feel personal and human. They also have serious potential for harm.

Iowa has set the right course in beginning to regulate AI, but these first steps must lead to further action.

In 2024, I helped draft the first legislation in Iowa to address concerns about AI. Those first laws targeted fake sexually explicit images, including deepfake pornography used to harass others and sexual abuse material involving minors. While this legislation addressed the malicious use of AI, it did not regulate the AI systems themselves.

That changed when Gov. Kim Reynolds signed Senate File 2417 into law. Beginning July 1, 2027, Iowa will, for the first time, regulate AI services  directly by establishing guardrails for conversational AI services, rather than merely punishing people who misuse these tools.

The law addresses concerns regarding transparency, consumer protection, and child safety. A user in crisis should not be manipulated by a chatbot into harming themselves. That is why this law will require these systems to make clear that they are AI systems, encourage users to seek help if they exhibit signs of suicidal ideation or self-harm, and prohibit them from representing that they can provide professional mental health services.

Nor should a child be drawn into sexual conversations by a system designed to keep them engaged. That is why for account holders under 18, the law will prohibit such systems from encouraging minors to commit sexual acts, prohibit companies from using addictive engagement tactics, and require tools for minors, and in some circumstances their parents or guardians, to manage privacy and account settings.

While this law addresses real issues, it also leaves several critical gaps that future legislation should address. Companies are not required to verify a user’s age, leaving an enforcement loophole if a minor claims to be an adult. Parental consent is not required before minors create accounts, and companies are not required to enable maximum privacy settings by default for minors.

Companies are not required to report serious safety incidents, submit to independent audits, or refrain from sharing or selling highly personal information that users provide to an AI system, such as health data. Finally, individual citizens are not able to sue AI companies for violating the law because only the attorney general has the authority to enforce these protections. Despite these shortcomings, SF 2417 provides a starting point for future AI regulation.

In the coming years, the Legislature has much work to do to address other risks posed by AI in areas such as elections, employment, housing, lending, and education. As some of the largest technology companies in the world watch, and quietly shape, AI regulation, Iowa must ensure that its elected officials put the needs of Iowans, rather than industry, first.

Social media changed society, but AI will reshape it. It will change how people learn, work, communicate, form relationships, and live. If we fail to act now to address the potential harms of this technology, we risk repeating the mistakes we made with social media: waiting to respond until the damage is done.