Chatbot Laws · verified Oct. 21, 2026
Would have required operators of public conversational AI services to disclose AI status (persistently, or at each session start and every 3 hours), take reasonable measures against sexual content for all account holders, add protections and parental tools for minors, run a suicide and self-harm protocol, and limit age-assurance data. Civil penalty $1,000 per violation up to $500,000 per operator, Attorney General only. Vetoed Jun 19, 2026.
Who it would cover
Operators that make a conversational AI service available to the public. Excludes app stores and search engines, developer tools, features inside other software, narrow-topic tools, business-only and internal tools, business and government customer-service bots, device voice assistants, and commerce or transaction helpers (§ 18-801(3), (8)).
What it would require
| AI disclosure | Operator must clearly disclose to each account holder that they are interacting with a conversational AI service, either by a persistent visible disclaimer or at the beginning of each session.When: Persistent, or each session start and at least every 3 hours§ 18-802(A) |
|---|---|
| Minors | Where the operator knows an account holder is a minor: no points or rewards at unpredictable intervals; reasonable measures against claims of being human or sentient, simulated emotional dependence, romantic or sexual innuendo and adult-minor romantic role-play; and privacy and account tools for minors, for parents of children under 13, and related tools for parents of older minors. 'Minor' means actual knowledge or reasonable certainty of being under 18.§ 18-801(6); § 18-802(B), (D), (E) |
| Age checks | Operators may not require a digital identification system solely to determine whether an account holder is a minor and must offer a privacy-preserving alternative if they offer one; age data must be minimal, not reused for advertising, and deleted or de-identified.When: Annual certification and public report by April 1§ 18-802(H)-(L) |
| Crisis protocol | Operator must adopt a protocol for prompts about suicidal ideation or self-harm that refers users to crisis services and prevents outputs that encourage, instruct or glorify suicide or self-harm.§ 18-802(F) |
| Reporting | By April 1 each year, operators that collect age data must certify under penalty of perjury that it was destroyed or de-identified and publish an aggregate report of age-assurance methods used.When: Annually by April 1§ 18-802(L) |
| Design limits | Reasonable measures to prevent sexual visual material, direct statements urging sexual conduct and sexual objectification of the account holder; no knowing and intentional representation that the service is designed to provide professional mental or behavioral health care.§ 18-802(C), (G) |
| Data limits | Data collected only to comply may not be used, sold or shared for targeted advertising, profiling or secondary monetization, and may be disclosed to government only under a warrant.§ 18-802(I)-(K) |
Enforcement
| Enforced by | Attorney General only§ 18-802(M)-(N) |
|---|---|
| Private lawsuits | No |
| Penalties | Injunction and the greater of actual damages or civil penalties of $1,000 per violation, not to exceed $500,000 per operator. No private right of action. |
Sources
- HB2311 bill overview, Arizona Legislature Supports: Votes and dates (House 43-13 Feb 24; Senate 28-0 Jun 11; House concurred and passed 35-20 Jun 12; to Governor Jun 13); Governor action Vetoed 06/19/2026.
- HB 2311 Senate Engrossed version, Arizona Legislature Supports: Bill text and Sec. 2 effective-date clause.
- Governor's veto letter file for HB 2311 Supports: Veto letter (scanned; text not readable).