Chatbot Laws · verified Oct. 21, 2026
From July 1, 2027, companion chatbot operators that allow children (under 18) must assess child-safety risks, publish a child safety policy, run a crisis protocol, set parent-only defaults (1-hour sessions, 2 hours a day, no push notifications, no persistent memory), offer parental controls, and avoid listed harmful behaviors and targeted ads. Independent audits begin by Jan 1, 2029. Public prosecutors and harmed children can sue. It replaces SB 243's known-minor duties.
Who must comply
Operators who make a companion chatbot (as defined in 22601) available to users in California. The age-assurance duty in 21811 applies to all operators; most other duties apply only to operators that allow child users once age is determined. Excludes colleges offering a chatbot only for educational settings and entities offering one only to their workers (21810.5(j)). Operators under $500,000,000 prior-year gross revenue are exempt from audits before Jan 1, 2032.
What it requires
| AI disclosure | Children must get an age-appropriate notice that they are interacting with AI, reinforced periodically during extended interactions. The general notice in 22602(a) for chatbots a reasonable person could mistake for a human remains.When: At the start and periodically during extended interactions (no set interval in the text)§ 21812(d)(4); § 22602(a) |
|---|---|
| Minors | Before offering a new or substantially modified chatbot, operators must document a child-safety risk assessment and mitigation, and publish a child safety policy. Defaults changeable only by a parent: persistent conversational memory off, push notifications off, one continuous session capped at one hour, and two hours of daily chatting; parental controls must include the ability to disable access for children under 16, and operators must promote them.§ 21812(a), (c), (d)(2)-(3); operative July 1, 2027 per § 21812(e) |
| Age checks | Operators must either determine each user's age (using age signals under the Digital Age Assurance Act, Civ. Code § 1798.500 et seq., or, if that fails, the age determination made under Health & Safety Code § 27001) or apply the child protections to all users. In the second case, parent-only defaults cannot be changed unless the operator has actual knowledge the user is not a child.§ 21811 |
| Crisis protocol | Operators must keep a documented protocol to reduce material risk of statements promoting suicidal ideation, suicide or self-harm, including referral to crisis services. If the operator determines there is a credible and imminent threat, it must do at least one of: notify a linked parent as soon as practicable (if that does not risk serious harm) and tell the child, or give streamlined access to 988 or an equivalent helpline.§ 21812(d)(1) |
| Reporting | Operators must get an independent third-party child safety audit by Jan 1, 2029 (or before first public availability, if later) and every two years, send an audit summary to the Attorney General within 30 business days, and post a high-level summary on their website within 90 days; the AG may obtain the full confidential report for cause. Operators must also offer a public incident-reporting mechanism, and the AG must create a public complaint mechanism by Jan 1, 2028.§ 21814 (version operative because AB 1405 was chaptered); § 21812(d)(7); § 21815 |
| Design limits | Toward children, a chatbot may not encourage self-harm, drug or alcohol use or disordered eating; produce obscene or sexual abuse material; claim to be human or sentient; discourage breaks or sharing safety concerns; express romantic interest; encourage emotional reliance or circumventing parental controls; use excessive flattery; or solicit purchases framed as necessary for the relationship. Dark patterns are barred in the design of safety controls.§ 21812(d)(5)(A); § 21813(a)(2)(C) |
| Therapy and licensed titles | A chatbot may not attempt to diagnose or treat a child's health condition unless it is FDA-regulated as a medical device and HIPAA-compliant.§ 21812(d)(5)(A) |
| Data limits | No cross-context behavioral advertising to children; no targeted advertising using a child's personal information from chats (labeled contextual ads are allowed); no sale of a child's personal information collected through the chatbot; no use or sharing beyond defined purposes.§ 21813(a); operative July 1, 2027 per § 21813(b) |
| Other duties | After a child's death or serious self-harm (or a credible-threat notice), the operator must notify a parent as soon as practicable if practicable and preserve exportable conversation records indicating serious self-harm or risk for at least three years; the child's account cannot be deleted while those records are held.§ 21812.5 |
Enforcement
| Enforced by | Public prosecutors described in Bus. & Prof. Code § 17204 and Private right of action for a child who suffers actual harm, or a parent or guardian§ 21816(a)-(c) |
|---|---|
| Private lawsuits | Yes |
| Penalties | Public prosecutors: civil penalty of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation, plus injunctive or declaratory relief (Attorney General), attorney's fees and other relief. Child or parent/guardian: actual damages, attorney's fees and costs, injunctive or declaratory relief; applies to violations of 21812(d)(1)-(5); financial harm must exceed $1,000 per child and emotional harm must be serious emotional distress. No private action under the Unfair Competition Law. |
Key dates
- Age assurance rules take effect; SB 243 duties toward known minors end
- Operator duties begin: risk assessment, crisis protocol, safety defaults, ad and data limits
- Attorney General complaint system and first usability test with children are due
- First independent child safety audit is due, then every two years
- Audit duty begins for operators with under $500 million in yearly revenue
Related laws
- California SB 243Companion chatbotsIn effect since Jan. 1, 2026; more from Jan. 1, 2027
- California SB 867Toys: companion chatbotsTakes effect Jan. 1, 2027
Note
SB 1119 removes the SB 243 duties toward known minors on January 1, 2027. Its own child safety duties begin July 1, 2027.
Sources
- Governor Newsom signs the strongest child safety chatbot and social media laws in the nation (Sept 10, 2026) Supports: SB 1119 signed Sept 10, 2026; named Adam's Law.
- SB 1119 (status), California Legislative Information Supports: Vote counts, enrollment Sept 9, approval and Chapter 190 on Sept 10, 2026.
- SB 1119 (text), California Legislative Information Supports: Section-level provisions, operative dates, penalties.
- Governor Newsom signs first-in-the-nation AI safeguards (Sept 9, 2026) Supports: AB 1405 signed Sept 9, 2026 (triggers the AB 1405-linked version of 21814).
- AB 1405 (text), California Legislative Information Supports: AB 1405 is Chapter 178, Statutes of 2026, approved Sept 9, 2026, no urgency clause.
- 2026 legislative calendar, California State Senate (official) Supports: Non-urgency statutes take effect Jan. 1 (Cal. Const. art. IV, sec. 8(c)); Aug 31, 2026 last day to pass bills; Sept 30 signing deadline.