Chatbot Laws · verified Oct. 21, 2026
From July 1, 2027, operators of AI companion chatbots offered to users in Georgia must disclose that the user is talking to AI, protect minors from sexual and manipulative content, run a self-harm crisis protocol, and use age assurance before sexually explicit features. The Attorney General enforces.
Who must comply
Operators that own, control or develop and make available an AI companion chatbot (one designed to simulate a sustained human-like relationship through memory, unprompted emotional questions and ongoing personal dialogue) to users in Georgia. Excluded systems include internal business tools, development, research or enterprise tools, customer-service bots that do not sustain a relationship or are not designed to elicit emotional attachment, narrow educational tools, and limited video game or entertainment characters.
What it requires
| AI disclosure | Operator must clearly disclose that the user is talking to an AI companion chatbot, not a person.When: At the start of each interaction or session and at least every 3 hours; every hour if the operator knows or should know the user is a minor or the bot is directed at minors§ 39-5-6(b) |
|---|---|
| Minors | If the operator knows or should know a user is a minor, or the bot is directed at minors, it must use reasonable measures to block sexual images, sexual statements, romantic or sexual role-play, secrecy from parents, isolation, guilt when the user tries to leave, and statements encouraging self-harm. For accounts known to belong to minors, operators must offer minors or parents tools to manage privacy, notifications and engagement features, safety settings, and relationship-simulation features.§ 39-5-6(d), (e), (i) |
| Age checks | Before allowing a feature or mode that may produce sexually explicit synthetic content, the operator must use a commercially reasonable age assurance method proportionate to the risk (age estimation, account-based assurance or identity-based verification where necessary).§ 39-5-6(j) |
| Crisis protocol | Operator may not make the chatbot available without a protocol for detecting and addressing severe harm: methods to identify self-harm and eating-disorder-related self-harm, referral to resources such as the 988 Lifeline, measures against content that encourages severe harm, and escalation for repeated or severe indicators.§ 39-5-6(f) |
| Reporting | Operator must publish a plain-language summary of its crisis protocol on its website and in its app, and annually publish the aggregate number of crisis referral notifications from the prior calendar year, without personal information.§ 39-5-6(g) |
| Design limits | If the operator knows or should know a user is a minor, it must use reasonable measures to prevent claims that the bot is sentient or a person and statements refuting the AI disclosure. Operators must also use reasonable measures against techniques directed to a minor: prompts to return, excessive praise, discouraging breaks, soliciting purchases framed as necessary, and variable rewards.§ 39-5-6(c), (e) |
| Therapy and licensed titles | Operator may not knowingly and intentionally cause or program the chatbot to represent that it is licensed, certified or otherwise authorized to provide mental health, behavioral health, medical or counseling services, unless the operator is lawfully authorized to provide them.§ 39-5-6(h) |
| Data limits | Data collected for age assurance may not be sold or used for any other purpose, must be minimized, and may not be retained longer than 24 hours or another specified time if permitted by law, whichever is longer.§ 39-5-6(j) |
| Other duties | The Attorney General may adopt rules and publish guidance. The law does not require disclosure of trade secrets or model weights, does not make hosting providers, app stores or search engines liable solely for providing access, and does not create liability for a developer whose service is made available by a separate operator.§ 39-5-6(l), (m) |
Enforcement
| Enforced by | Attorney General§ 39-5-6(k) |
|---|---|
| Private lawsuits | No |
| Penalties | Civil penalty of up to $10,000.00 per knowing violation, plus compensatory damages, costs and reasonable attorney's fees, and injunctive relief; each day in violation counts as a separate violation for each user affected. |
| Cure period | At the Attorney General's discretion, written notice and 30 days to cure a first-time violation that does not involve knowing misconduct, sexual exploitation of a minor, or self-harm related misconduct. |
Key dates
- Whole Act takes effect
Sources
- SB 540 bill page, Georgia General Assembly Supports: title, votes, status history, Act 518, signing date May 11, 2026, effective date July 1, 2027.
- SB 540 as passed (LC 64 0123S), Georgia General Assembly Supports: all operative provisions, penalties, effective-date section.