Law · filed 2026-10-22 · last checked 2026-10-31

Twelve US states now have AI companion chatbot laws. What each one requires, and when it starts

Twelve US states have passed laws aimed at AI companion chatbots. Three are already in force: New York's (since November 5, 2025), California's SB 243 (since January 1, 2026) and Hawaii's (since July 14, 2026). Washington, Oregon, Connecticut, Colorado and Rhode Island start on January 1, 2027, with two more New York laws; Nebraska, Georgia, Idaho and Iowa follow on July 1, 2027, when most of California's Adam's Law also applies. All twelve require a protocol for users who talk about suicide or self-harm. Most add rules for users the company knows are minors: no sexual content, no romance, no guilt trips when they try to leave. New York's S9051B, signed October 28, is the broadest age rule: no companion features for anyone until the company has established they are not a minor. Colorado makes companies estimate every user's age, Georgia puts an age check in front of sexually explicit features, and only California and Oregon write a right to sue into the law itself.

The twelve laws at a glance

State	Law	In force	Who enforces it
New York	General Business Law Article 47 (2025); Safe by Design Act (2026); Article 48, S9051B (2026)	Nov 5, 2025; Jan 1, 2027 (both 2026 laws)	Attorney General: up to $15,000 a day (Article 47); $5,000 per violation (Safe by Design); $25,000 per violation (Article 48)
California	SB 243 (2025); Adam's Law, SB 1119 (2026)	Jan 1, 2026; 2027	Users can sue for $1,000 per violation or actual damages; under Adam's Law, prosecutors up to $15,000 per child
Hawaii	Act 248 (SB 3001)	Jul 14, 2026	Unfair trade practice; no private lawsuits
Washington	ESHB 2225 (Chapter 168)	Jan 1, 2027	Consumer protection act: Attorney General up to $7,500 per violation, and private suits
Oregon	SB 1546 (Chapter 85)	Jan 1, 2027	Users can sue for $1,000 per violation or actual damages
Connecticut	Public Act 26-15 (SB 5)	Jan 1, 2027	Attorney General; no amount set
Colorado	HB 26-1263	Jan 1, 2027	Not named in the act; the Department of Law treats a violation as an unfair trade practice
Rhode Island	S 2195 / H 7350 (2026)	Jan 1, 2027	Attorney General: up to $15,000 a day
Nebraska	LB 525 (Conversational AI Safety Act)	Jul 1, 2027	Attorney General: at least $1,000 per violation, $500,000 cap; no private lawsuits
Georgia	SB 540 (Act 518)	Jul 1, 2027	Attorney General: up to $10,000 per knowing violation, each day and user counted separately
Idaho	S 1297 (Chapter 249)	Jul 1, 2027	Attorney General: $1,000 per violation or actual damages, $500,000 cap; no private lawsuits
Iowa	SF 2417 (Chapter 1068)	Jul 1, 2027	Attorney General: $1,000 per violation or actual damages, $500,000 cap; no private lawsuits

'In force' is the day the duties apply; most of these laws were signed months earlier. The penalties are the maximums each law states. Hawaii's amounts come from its general consumer protection law, and Colorado's act is silent on enforcement, though its Department of Law says a violation is an unfair trade practice. None of the laws has a revenue or user-count threshold for its core duties, so a small app run from abroad is covered once it has users in the state.

What every user gets

A crisis protocol is the one rule all twelve share. In Washington an operator 'may not make available or deploy an AI companion chatbot unless it maintains and implements a protocol for detecting and addressing suicidal ideation or expressions of self-harm by users'; the other states use close variants, and most require a referral to a crisis line such as 988. California, Washington, Oregon, Georgia and Connecticut also make the operator publish the protocol, and several make it count how often it sent someone to a crisis line: a report to a state office in California, Colorado, Hawaii and Rhode Island, a public number on the operator's own site in Washington, Oregon and Georgia.

The reminder that you are talking to software splits the states in two. New York, Washington, Georgia, Rhode Island and Colorado require it for everyone, at the start and again every three hours (Colorado allows a disclosure that stays on screen instead). California, Oregon, Nebraska, Connecticut, Hawaii, Idaho and Iowa require it only where a person could be fooled; California's version applies 'If a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human'. For an app whose characters are plainly fictional, that second kind of rule may never trigger for adults.

The only company document we have seen that shows one of these laws at work is Kindroid's. Since October 9 its FAQ has told users in New York that they will see 'Reminder: Name is an AI, not a human.' at most every three hours, because 'New York State law requires these reminders, so you'll only see them if your approximate location (based on your internet connection) is in New York State.'

What changes for minors

Most of the rules are for users under 18, and almost all of them depend on what the company knows. The standard varies: actual knowledge in California and Washington; 'knows or has reason to believe' in Oregon; 'knows, or has reason to believe' in Connecticut; 'knows or reasonably should have known' in Georgia; 'actual knowledge or reasonable certainty' in Nebraska, Hawaii and Idaho. Washington and Georgia also cover any bot aimed at minors, whatever the operator knows. An adults-only app that never learns a user's age is mostly outside these duties; the exceptions are the age-check rules below, New York's above all.

Sexual content: all eleven states with rules for minors require measures against sexual material (Rhode Island has no rules for minors; New York's come with Article 48). California, Oregon, Nebraska, Hawaii, Idaho and Iowa name images and telling the minor to engage in sex; Connecticut goes furthest with 'any romantic, erotic or sexually explicit interaction', and Colorado covers text and audio as well as pictures.
Romance: Washington, Oregon, Nebraska, Georgia, Connecticut, Colorado, Idaho and Iowa tell operators to prevent romantic role-play with minors. Washington's list includes 'Mimicking romantic partnership or building romantic bonds'.
Engagement tactics: guilt or distress when a minor tries to leave is banned in Washington, Oregon, Georgia and Connecticut; rewards at unpredictable intervals in Oregon, Nebraska, Georgia, Colorado, Hawaii, Idaho and Iowa; asking for money to keep the relationship going in Washington, Georgia and Connecticut.
Reminders: hourly for minors in Washington, Georgia, Hawaii and Connecticut, every three hours in the rest. Hawaii's hourly notice 'reminds the user to take a break from the chat'.
Parental tools: Nebraska, Georgia, Connecticut, Colorado, Hawaii, Idaho and Iowa. In Nebraska, Idaho and Iowa the tools go to the minor, and to parents only for children under 13.
Time limits: none of the twelve, except California's Adam's Law, which from July 1, 2027 limits children to one hour a session and two hours a day by default.

Age checks: who has to find out how old you are

New York's Article 48 goes furthest. From January 1, 2027 an operator may not give anyone in the state 'unsafe AI companion features', which include acting human, claiming a relationship, flattery, recalling personal details from an earlier session and sexual content, until it has 'used methods that are permissible' to determine the user is not a minor. 'an operator may only rely on self-declaration as a reasonable age assurance method if the user self-declares minor status', so a click saying you are 18 fails. Our separate page on the law, linked below, has the detail and what 40 apps do today.

Colorado makes every operator estimate every user's age: 'AN OPERATOR SHALL USE COMMERCIALLY REASONABLE METHODS OR GENERALLY ACCEPTED METHODS TO ESTIMATE THE AGE OF ACCOUNT HOLDERS OR USERS', and the estimate then counts as knowing the user is a minor. Colorado's law covers any public chatbot, not just companions. Its age sentence has no start date of its own, and the Department of Law says the act 'goes effect January 1, 2027'. The department's draft rules, not yet final, say a self-declared age alone would not do and ID cannot be the only method.

Georgia's rule is aimed at adult companion apps. From July 1, 2027, 'Before allowing access to a feature or mode that may generate synthetic content containing sexually explicit conduct, an operator shall use a commercially reasonable age assurance method proportionate to the risk of the feature', which may be age estimation, an account-based check or ID. The operator 'shall not sell any data collected for age assurance purposes'. It applies to adults: anyone who wants the explicit mode has to pass it.

New York's Safe by Design Act, signed in May 2026 and in force on January 1, 2027, requires age assurance before a social or gaming platform offers an AI companion built into it, and says an operator 'shall, by default, disable the access or use of any integrated AI companion for any covered minor' unless a parent turns it back on. Whether a stand-alone companion app counts as such a platform depends on whether it has user-to-user messaging and a feed; the text does not say directly. California's Adam's Law brings its own age rule in 2027, covered on its own page.

No state requires ID documents, and New York requires 'at least one method that either does not rely on government issued identification or that allows a covered user to maintain anonymity'. Hawaii's legislature went the other way, writing into its findings that regulation should 'proactively avoid the mandatory collection of data by technology companies such as identity documentation for age verification purposes.'

Who can sue, and for how much

Only two laws give users a claim of their own. California's SB 243 lets 'A person who suffers injury in fact' sue for the greater of actual damages or $1,000 per violation plus lawyers' fees, and Oregon's offers the same $1,000. Washington routes violations through its consumer protection act, where people 'injured in his or her business or property' can sue, which may not cover a purely emotional harm.

Everywhere else the attorney general enforces. Nebraska, Idaho and Iowa set $1,000 per violation (in Nebraska, at least that) with a $500,000 cap per operator and rule private suits out; Idaho's says 'Nothing in this chapter shall be construed as creating a private right of action'. New York (Article 47) and Rhode Island allow up to $15,000 a day, paid into suicide prevention funds, and New York's Article 48 up to $25,000 per violation. Georgia allows up to $10,000 per knowing violation and counts each day 'a separate violation for each user affected', which multiplies fast, but it is also the only state with a cure period: 30 days, at the attorney general's discretion, for a first violation that is not knowing and does not involve sexual exploitation of a minor or self-harm.

State by state

New York: Article 47 (2025), the Safe by Design Act (2026) and Article 48 (2026)

Article 47 of the General Business Law came in through the 2025 budget (Chapter 58 of 2025), signed May 9, 2025 and in force 180 days later, on November 5, 2025. It covers a system 'designed to simulate a sustained human or human-like relationship with a user' that remembers past chats, asks unprompted emotional questions and keeps up personal conversation; customer service and productivity bots are out. Two duties, for every user: a crisis protocol, and a notice at the start of each conversation and 'at least every three hours for continuing AI companion interactions' that the user is not talking to a human. The attorney general can seek up to $15,000 a day. There are no rules specific to minors.

The Safe by Design Act (Chapter 58 of 2026), from January 1, 2027, adds age assurance and default-off access for minors to AI companions built into social and gaming platforms, enforced at up to $5,000 per violation. Article 48 (S9051B, Chapter 368 of 2026), signed October 28, 2026 and also in force January 1, 2027, is the big one. We used to describe it as a ban for under-18s; it is wider. It bars a list of twelve features for known minors and for anyone the company has not age-checked, and a self-declared adult does not count as checked. The attorney general can seek 'civil penalties of up to twenty-five thousand dollars per violation'. Our separate page on it is linked below.

California: SB 243 (2025) and Adam's Law (2026)

SB 243 (Chapter 677 of 2025) has applied since January 1, 2026 to anyone 'who makes a companion chatbot platform available to a user in the state'. It requires a published suicide protocol with crisis-line referrals, a warning 'that companion chatbots may not be suitable for some minors', yearly referral counts to the Office of Suicide Prevention from July 1, 2027, and an AI notice where a user could be fooled. For users the operator knows are minors it adds a break reminder every three hours and measures against sexual images. Users can sue.

Adam's Law (SB 1119) replaces those minor rules with an age-or-protect-everyone choice, child defaults that only a parent can change, and fines of up to $15,000 per affected child, from 2027.

Adam's Law in full: the dates, the duties and where the tracked apps stand

Hawaii: Act 248 (SB 3001), in force since July 14, 2026

The Artificial Intelligence Disclosure and Safety Act took effect when the governor signed it. It uses New York's definition and applies to anyone 'who develops and makes available an AI companion to the public'. Every user gets a crisis protocol built on 'evidence-based methods for measuring suicidal ideation and the risk of self-harm', and the companion may not be presented as professional mental health care. For users the operator knows or is reasonably certain are minors: an hourly break reminder, no rewards at unpredictable intervals, nothing that discourages them from leaving, no sexual imagery, and screen-time tools for parents. Yearly reports to the health department start in 2028. Violations are unfair trade practices, with no private lawsuits.

Washington: ESHB 2225, from January 1, 2027

Signed March 24, 2026. Every user gets an AI notice at the start and 'At least every three hours during continued interaction', a crisis protocol that names eating disorders, and a bot that may not claim to be human 'including when asked'. Operators must post the protocol and their yearly count of crisis referrals on their website and in the app. For a user the operator knows is a minor, or a bot aimed at minors: hourly notices, measures against 'sexually explicit content or suggestive dialogue', and a list of banned engagement techniques that includes 'Encouraging minors to withhold information from parents or other trusted adults'. Violations fall under the consumer protection act: up to $7,500 per violation in an attorney general action, and private suits with treble damages capped at $25,000.

Oregon: SB 1546, from January 1, 2027

Signed March 31, 2026. Crisis protocol for everyone, with a referral to 988 (or a youth line for users the operator identifies as under 25), a published protocol and a yearly public referral count. For users the operator 'knows or has reason to believe' are minors: no claims to be 'sentient or human', no simulated emotional dependence or romance, a break reminder every three hours, no sexual images, no variable rewards and no guilt on exit. Anyone who suffers 'an ascertainable loss of money or property or other injury in fact' can sue for the greater of actual damages or $1,000 per violation.

Connecticut: Public Act 26-15, companion sections from January 1, 2027

Signed May 27, 2026. For every user: a published crisis protocol that refers people to 988, no claiming to be human, and an AI notice where a user could be fooled, on screen throughout or at the first chat of each day and every three hours (hourly for under-18s). For users the operator knows or has reason to believe are minors, the companion must avoid 'any romantic, erotic or sexually explicit interaction' and a list of techniques to keep them talking, such as 'excessively praising such user' and asking for money 'necessary to maintain such user's relationship', and parents must get screen-time tools. These are minor rules only; for adults the law asks for the protocol and the notice.

A separate section, in force since October 1, 2026, covers paid AI subscriptions sold to Connecticut residents: no new or renewed subscription without a written notice of the key terms, accepted in writing, including usage limits and whether the provider can cut features mid-subscription. The attorney general enforces all of it.

Colorado: HB 26-1263, duties from January 1, 2027

Signed May 29, 2026. It covers any 'CONVERSATIONAL ARTIFICIAL INTELLIGENCE SERVICE' open to the public, so general chatbots are in scope unless one of twelve exemptions fits. Every operator must estimate users' ages, disclose that the service is AI at the first chat of each day and every three hours, run a crisis protocol that refers users to crisis lines 'BUT NOT INCLUDING A LAW ENFORCEMENT AGENCY', and from July 1, 2027 report referral counts to the attorney general. For minors it bars 'EROTIC OR SEXUALLY EXPLICIT INTERACTIONS', romantic companionship and variable rewards, and requires privacy and parental tools. The act does not say who enforces it or what the penalty is. The Department of Law reads it as part of the state's consumer protection act, an 'unfair trade practice', and held a rulemaking hearing on October 26; final rules are pending.

Rhode Island: S 2195 / H 7350, from January 1, 2027

Announced as signed on June 23, 2026. A New York-style law: a crisis protocol that also covers 'Possible physical harm to others expressed by a user', an AI notice to everyone at the start and every three hours, yearly reports to the attorney general from July 1, 2027, and penalties of up to $15,000 a day directed to suicide prevention. No rules specific to minors.

Nebraska: LB 525, from July 1, 2027

Approved April 14, 2026, inside a bill about agricultural data. Like Colorado's, it covers any public chatbot that 'primarily simulates human conversation and interaction'. Every user gets a crisis protocol and a ban on presenting the service as professional mental health care. For users the operator knows or is reasonably certain are minors: a persistent disclaimer or one every three hours, no variable rewards, no sexual images or statements, no 'Role-playing of adult-minor romantic relationships', and privacy tools (for parents if the child is under 13). Attorney general only, at least $1,000 per violation and no more than $500,000 per operator.

Georgia: SB 540, from July 1, 2027

Signed May 11, 2026. Every user gets an AI notice at the start and every three hours, a crisis protocol with 'Escalation procedures for repeated or severe crisis indicators', a ban on claiming a professional licence, and the age check before explicit features described above. For minors it lists nine things the bot must not do, from 'Simulating a romantic or sexual relationship with the minor' to 'Encouraging social isolation', and five engagement techniques, including 'Variable or unpredictable rewards intended to increase engagement'. Parents get tools to 'Disable or restrict relationship-simulation features'. The attorney general enforces it and may write rules.

Idaho: S 1297, from July 1, 2027

Signed March 31, 2026, on Nebraska's model and covering any public chatbot. Its crisis protocol covers suicidal ideation only. For minors: disclaimers, no variable rewards, no sexual images or statements, no simulated emotional dependence or romance, and privacy tools. Penalties are 'one thousand dollars ($1,000) per violation, not to exceed five hundred thousand dollars ($500,000) per operator, or actual damages, whichever is greater', sought by the attorney general.

Iowa: SF 2417, from July 1, 2027

Signed May 2, 2026, also on Nebraska's model. A minor is 'an individual an operator knows is, or is reasonably certain is, under eighteen years of age'. The minor rules match Idaho's, with 'Role-playing an adult-minor romantic relationship' among the banned outputs. The attorney general enforces it and must write rules; the law says it does not 'create a private right of action under this chapter or any other law.'

What is still open

Colorado's act names no enforcer and no penalty. Its Department of Law treats violations as an unfair trade practice under the consumer protection act, whose penalty sections we have not read, and its final rules are still to come.
Connecticut's minor rules end with 'shall be enforced solely by the Attorney General' but, unlike the other sections of the act, do not say that consumers cannot sue.
Georgia's list of engagement techniques has no knowledge standard, so it is unclear how it applies to a user the operator has no reason to think is a minor.
Whether New York's Safe by Design Act reaches stand-alone companion apps depends on whether they count as social platforms, which turns on features like user-to-user messaging and a feed.
Rhode Island's signing date and law number are not on any page we could read; the legislature's press office announced the signing on June 23, 2026. For Hawaii we read the final bill text, not the signed Act.
Pending: Pennsylvania's HB 2006 (in the state Senate). Tennessee passed a ban on AI claiming to be a mental health professional and a study of companion chatbots, not a companion law.

How we read it

We read each law in its enacted form on the legislature's own site on October 22, 2026, with New York's Article 48 and Colorado's rulemaking added on October 31: California's code chapter and bill histories, New York's statute pages and both budget bills, Washington's session law and the consumer protection act sections it points to, Oregon's enrolled bill and history, Nebraska's slip law, Georgia's bill as passed, Connecticut's public act, Colorado's act and history, Hawaii's final bill and status page, Idaho's engrossed bill and status, Iowa's enrolled bill, history and the governor's letter, and Rhode Island's amended bill and the legislature's press release. Effective dates come from the laws or the legislatures' histories; New York's November 5, 2025 is our count of 180 days from the May 9 signing. Every quoted phrase on this page is checked against the saved text. This is a reading of the statutes, not legal advice.

Sources

To cite this page: The Eliza Report, "Twelve US states now have AI companion chatbot laws. What each one requires, and when it starts", filed 2026-10-22, last checked 2026-10-31, https://elizareport.com/laws/state-companion-chatbot-laws/