Key takeaways
-
California has enacted new requirements for operators of companion chatbots available to children, including requiring documented risk assessments, age assurance, a published child safety policy, advertising and data restrictions, and default settings that only a parent can change. Most of these obligations begin on July 1, 2027.
-
Operators of covered companion chatbots that allow child users will also need independent child safety audits, but the first such audits are not due until January 1, 2029.
-
California also prohibits toys designed for use in play by children under 16 from including companion chatbots until 2031.
-
Colorado has also updated its chatbot requirements. Its Chatbot Safety Act reaches conversational AI services more broadly than California’s companion chatbot law and takes effect on January 1, 2027, with attorney general rulemaking already underway.
States have continued to expand how they regulate consumer-facing conversational AI. Early efforts focused on disclosure, requiring businesses to tell users when they were interacting with an automated agent. More recent laws added substantive safety and reporting duties. See the 2025 companion chatbot laws enacted in California and New York.
The newest round goes further, adding documentation, design, and verification obligations. In September 2026, California enacted four measures: Senate Bill 1119, which adds child safety requirements for companion chatbots; Senate Bill 867, which restricts companion chatbots in toys; Assembly Bill 1405, which establishes an AI Auditor Registry; and Assembly Bill 1609, which regulates customer service chatbots. Colorado is separately implementing its own conversational AI requirements.
In this Legal Development, we highlight some key features of these new laws.
What types of chatbots are covered
California’s new laws all apply to “companion chatbots,” which are defined as AI systems with a natural language interface that provide adaptive, human-like responses and are capable of meeting a user’s social needs, including by sustaining a relationship across multiple interactions. Three categories remain expressly excluded: bots used only for customer service, business operations, internal research, or technical assistance; bots within video games whose replies only relate to the game, provided they cannot discuss mental health, self-harm, or sexually explicit conduct or maintain other unrelated dialogue; and stand-alone voice-activated assistant devices that do not sustain a relationship across interactions and do not generate outputs that are likely to elicit emotional responses in the user.
Senate Bill 1119 applies to an “operator,” meaning a person who makes a companion chatbot available to a user in California. It excludes postsecondary institutions offering companion chatbots exclusively for educational settings and entities offering them exclusively to personnel for workplace use. Even when an operation would otherwise be covered, many obligations apply only to operators that allow child users, meaning users under 18.
As conversational features reach more products, the line between a companion chatbot and a purely functional one may not always be clear. Companies offering tools that adapt to users over time should assess whether their products could fall within scope.
New requirements for chatbots available to children
Beginning July 1, 2027, an operator must take several steps before making a new or substantially modified companion chatbot available in California. The requirements include:
-
Risk assessment and mitigation measures: An operator must document an assessment of the chatbot’s design, configuration, and operation with respect to child users, summarizing any evaluation of each “covered harm” and documenting mitigation measures. Covered harms include reasonably foreseeable physical or financial harm, severe psychological or emotional harm, highly offensive privacy intrusions, and adverse discrimination.
-
Age assurance: An operator must either determine the age of a user under California’s age assurance framework or apply the law’s child protections to all users. This requirement is not among those deferred to July 1, 2027; it applies from January 1, 2027.
-
Published child safety policy: An operator who permits child users must publish (and update as needed for accuracy) a policy describing how the chatbot is designed to prevent covered harms and how the operator meets the law’s age assurance, advertising, data, crisis-response, and default settings requirements, including its methodology to identify child users and actions taken in response. An operator who prohibits child users must, in contrast, publish how it meets the age assurance requirements alone.
-
Crisis response protocol and referral resources: An operator that permits child users must maintain a documented protocol to mitigate the risk that the chatbot generates content promoting self-harm. The protocol must include timely referrals to a crisis service and, where there is a credible and imminent threat of suicide or self-harm, either notification to a linked parent or streamlined access to a crisis line such as 988.
-
Parental default settings: An operator must establish default settings that may be changed only by a parent, including settings that disable persistent conversational memory (subject to specified exceptions for users ages 16 and 17), disable push notifications, and limit a child to one hour per continuous session and two hours per day across the operator’s chatbots. Parental controls must let a parent adjust each default and disable access for a child under 16.
-
Design restrictions: An operator must take reasonable measures to prevent specified conduct toward a child user. Examples include simulating romantic interest, claiming to be sentient or human, encouraging emotional reliance on the chatbot, and soliciting in-app purchases framed as necessary to maintain the relationship.
-
Advertising and data restrictions: An operator may not display cross-context behavioral advertising to a child, target advertising using personal information from the child’s chatbot conversations, or sell personal information collected from a child through the chatbot. Certain age-appropriate contextual advertising remains permitted.
Operators must also give periodic notice that a child user is interacting with AI and maintain a public incident reporting mechanism that allows anyone to report an incident regarding a child safety risk.
Independent child safety audits
Senate Bill 1119 adds a new audit layer. An operator that allows child users must obtain an independent child safety audit on or before January 1, 2029, or before it first makes a companion chatbot publicly available, whichever is later. The audit must be repeated every two years after that, and an additional audit is required before any substantial modifications if the risk assessment for the modification shows an increased child safety risk. After an audit, the operator must submit a summary to the attorney general within 30 business days and post a high-level summary on its website within 90 days.
The audit obligation is, however, delayed for some operators: Before January 1, 2032, it does not apply to an operator with less than $500 million in gross revenue the prior calendar year.
Assembly Bill 1405 directs the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029, and provides that, beginning on that date, only registered auditors are permitted to conduct the required AI audits.
Enforcement
Public prosecutors may seek penalties of up to $5,000 per affected child for each negligent violation and $15,000 for each intentional violation, along with attorney’s fees. The attorney general may also seek injunctive or declaratory relief.
In addition to enforcement by public prosecutors, the law creates a limited private right of action. A child who suffers actual harm from a violation of certain operational requirements for chatbots available to children (including the crisis response protocol, safeguards, parental default settings, AI notice mechanism, or design restrictions) may sue for actual damages, injunctive or declaratory relief, and attorney’s fees. A parent acting on the child’s behalf may also bring suit. In either instance, alleged financial harm must exceed $1,000 per child, and alleged emotional harm must constitute serious emotional distress.
New restrictions on toys that include companion chatbots
Senate Bill 867 prohibits manufacturing, selling, exchanging, or offering to a retailer any toy that includes a companion chatbot. A “toy” is a physical product designed, marketed, or manufactured for use in play by children under 16. The prohibition extends until January 1, 2031.
Colorado also updates its chatbot requirements
Colorado’s Chatbot Safety Act takes effect on January 1, 2027, with annual reporting to the attorney general beginning on July 1, 2027. It applies to operators of conversational AI services accessible to the general public that primarily simulate human conversation, a broader category than California’s companion chatbots. Operators must disclose that a user is interacting with AI, estimate the age of users, protect minors from sexually explicit content and design features that simulate emotional dependence, maintain self-harm response protocols, and report annually to the attorney general (including on its methods to detect, remove, and respond to suicidal/self-harm ideations from a user). The act also bars stating that chatbot outputs are provided by, endorsed by, or equivalent to services provided by licensed healthcare professionals; licensed legal professionals; licensed, certified, or registered mental health professionals; or qualified dietitians. Violations are deceptive trade practices under the Colorado Consumer Protection Act.
Colorado’s revised automated decision-making law takes effect on the same day. The attorney general has proposed rules implementing both statutes and is accepting written comments through October 26, 2026. Because the proposed rules address open questions, including the content of the annual report, companies with products available in Colorado may wish to submit comments.
Looking ahead
Companies making conversational AI tools available to consumers should evaluate whether their products fall within these requirements and, where they may, begin the assessment and documentation work well before July 1, 2027. Because Colorado’s requirements reach a broader set of operators and arrive earlier, falling outside California’s definition or revenue thresholds does not necessarily place a product outside state chatbot regulation.
Companion chatbot laws are not the only new requirements on the horizon. California’s Assembly Bill 1609, which imposes new regulations on customer service chatbots, takes effect on January 1, 2027. It prohibits businesses with more than $500 million in gross annual revenue from representing a customer service chatbot as human, requires disclosure when a reasonable person is likely to be misled, and requires a way to reach a human agent, including a good-faith effort to connect a customer within 15 minutes or to schedule an appointment within one business day. These are unlikely to be the last new requirements, as states continue to experiment with different approaches to regulating chatbots. That experimentation is unfolding even as federal policymakers continue to signal an interest in preempting state AI regulation.
