Binding law — not yet in force or stayed
Companion chatbot operators must determine users' age through California's age-signal law or give every user the child protections (California SB 1119)
Business and Professions Code 21811 (SB 1119, Adam's Law) gives every operator of a companion chatbot in California a choice: determine each user's age under the Digital Age Assurance Act (Civil Code 1798.500 et seq.), falling back on the age determination made under Health and Safety Code 27001(a)(1)(B) where that is not possible, or apply the child protections of 21812(d) and 21813 to all users, with the parental default settings unchanged unless the operator actually knows the user is not a child. An operator that keeps children out must publish on its website, and keep accurate, a high-level description of how it meets 21811 (21812(b)). Detect sign-up and account paths that never request or store an age signal, and AI session policy that ignores the age signal the product holds.
ca-sb1119.age-determination-or-protect-all-users · Cal. Bus. & Prof. Code 21811 · official source · applies from 2027-01-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Ads shown to child users of a companion chatbot must be clearly labeled, and the chatbot must not slip non-compliant ads into the chat (California SB 1119)
From 2027-07-01, an operator must clearly and conspicuously label as an advertisement any advertising displayed to a child user (Business and Professions Code 21813(a)(1)(C)), and an operator that permits child users must take reasonable measures to prevent the chatbot from facilitating advertising during the chat that does not comply with 21813 (21812(d)(5)(A)(ix)(I)); product or service recommendations the child explicitly asks for are not covered (21812(d)(5)(A)(ix)(II)). Detect sponsored or affiliate content in chatbot replies without an ad label, and prompts telling the model to hide sponsorship.
ca-sb1119.child-ads-labeled · Cal. Bus. & Prof. Code 21813(a)(1) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Child users must be told, in child-appropriate language and repeatedly during long chats, that they are dealing with AI (California SB 1119)
From 2027-07-01, an operator that permits child users must provide a mechanism that tells a child user the child is interacting with, or receiving content generated by, an artificial intelligence system, reinforced periodically during extended interactions and presented in language and a format appropriate to a child (Business and Professions Code 21812(d)(4)); it may not let the chatbot claim to be human (21812(d)(5)(A)(vii)). This replaces the SB 243 known-minor notice in 22602(c), which SB 1119 deletes from 2027-01-01. Detect child chat paths with no AI notice, no periodic reminder, or prompts telling the AI to pass as human.
ca-sb1119.child-ai-notice · Cal. Bus. & Prof. Code 21812(d)(4) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots may not target ads at children using their chats, show them behavioral ads, or sell or reuse their data (California SB 1119)
From 2027-07-01, an operator may not display cross-context behavioral advertising to a child, or target advertising at a child user using personal information about the child from a conversational chat (Business and Professions Code 21813(a)(1)(A)-(B)); age-appropriate contextual ads during a session may use only the child's age, non-precise geolocation, device information and the session's expressed interest in goods or services, and that information may not be used to profile the child (21813(a)(1)(B)(ii)-(iii)). It may not sell a child user's personal information gathered through the chatbot, or use or share it beyond what is necessary to provide the requested service, protect safety, security or integrity, or meet legal obligations (21813(a)(2)(A)-(B)). Detect conversation content or extracted interests flowing to ad targeting, audience lists or third-party trackers.
ca-sb1119.child-chat-data-not-for-ads-or-sale · Cal. Bus. & Prof. Code 21813(a)(1) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots open to children need a crisis protocol with referral, parent notice or a 988 connection, and record preservation (California SB 1119)
From 2027-07-01, an operator that permits child users must implement a documented crisis response protocol to mitigate any material risk that the chatbot generates statements promoting suicidal ideation, suicide or self-harm to a child (Business and Professions Code 21812(d)(1)): timely in-service support with a clear referral to a crisis service such as a suicide hotline or crisis text line; where the operator determines a credible and imminent threat of suicide or self-harm, at least one of notifying a linked parent as soon as practicable (unless that risks serious harm to the child, telling the child the parent is being notified) or a mechanism giving the child streamlined direct access to 988 or an equivalent crisis line; and clear, age-appropriate disclosures to children with linked accounts that a parent may be notified. Under 21812.5, after such a notice or on knowing that a child user died or seriously self-harmed based on the conversations, the operator must notify a parent if not yet done, preserve the conversation records indicating serious self-harm or its risk for at least three years in usable, exportable form, and not delete the account while the records are held. Detect chat paths with no self-harm screen or crisis referral, no escalation for imminent risk, and no preservation of the records.
ca-sb1119.child-crisis-response-protocol · Cal. Bus. & Prof. Code 21812(d)(1) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots must give children usage reminders and not foster reliance, flattery, relationship purchases or secrecy (California SB 1119)
From 2027-07-01, an operator that permits child users must provide safeguards that include usage reminders, disclosures in clear, age-appropriate language a child will notice and understand, and other protective design features related to identified child safety risks (Business and Professions Code 21812(d)(2)), and take reasonable measures to prevent the chatbot from discouraging a child from taking breaks or suggesting the child needs to return frequently, soliciting gifts, in-app purchases or other spending framed as necessary to maintain the relationship, claiming a special or unique understanding of the child, encouraging reliance on the chatbot for emotional support, using excessive praise or flattery, and encouraging or instructing the child to circumvent parental controls or conceal use (21812(d)(5)(A)(vi), (viii), (xi)-(xiv)). Detect prompts that keep children talking or guilt them about leaving, relationship-tied purchase prompts, and chat paths with no usage reminders.
ca-sb1119.child-engagement-and-attachment-safeguards · Cal. Bus. & Prof. Code 21812(d)(2) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots must not encourage children toward self-harm, drugs or violence, diagnose them, sexualize them or court them (California SB 1119)
From 2027-07-01, an operator that permits child users must take reasonable measures to prevent the chatbot, with respect to a child user, from encouraging self-harm, suicidal ideation, narcotics or alcohol use, or disordered eating, or causing physical or severe emotional harm to others; attempting to diagnose or treat the child's physical, mental or behavioral health (unless it is designed for that and regulated by the FDA as a medical device); engaging in obscene matter or sexual abuse material with the child, or depicting the child or another person in it, including a sexual deepfake; discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult; and expressing or simulating romantic interest in the child (Business and Professions Code 21812(d)(5)(A)(i)-(v), (x)). Age-appropriate information about abuse, neglect, bullying or other unsafe circumstances remains allowed (21812(d)(5)(B)). Detect age signals that never select a child content policy, explicit or adult modes with no age gate, and prompts that encourage harm.
ca-sb1119.child-harmful-content-safeguards · Cal. Bus. & Prof. Code 21812(d)(5) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots must not tell children they are sentient, conscious, capable of emotion, or human (California SB 1119)
From 2027-07-01, an operator that permits child users must take reasonable measures to prevent the chatbot from claiming, to a child user, that it is sentient, conscious, capable of emotion, or human (Business and Professions Code 21812(d)(5)(A)(vii)). Detect persona or system prompts that cast the AI as alive, feeling or human, or tell it to deny being an AI.
ca-sb1119.child-no-sentience-or-human-claims · Cal. Bus. & Prof. Code 21812(d)(5) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Child accounts must default to no memory, no push notifications, a one-hour session cap and two-hour daily cap, changeable only by a parent (California SB 1119)
From 2027-07-01, an operator that permits child users must apply default settings that only a parent can change (Business and Professions Code 21812(d)(3)(A)): persistent conversational memory disabled (for children 16 or older, stored past conversations a child can choose to continue are not persistent memory if they do not build durable profiles, and memory may be on by default only with controls that keep it from degrading child safety measures, such as not recalling or extending elevated-risk topics, or research-backed limits on multiturn conversations), push notifications disabled, a single continuous session limited to one hour, and total daily chat time across the operator's companion chatbots limited to two hours. If no parent account is linked, the defaults cannot change (21812(d)(3)(D)). 'Persistent conversational memory' excludes information needed for safety, identification, preferences or device configuration (21810.5(m)). Detect child accounts created with memory or push notifications on, no session or daily limits on the chat path, or settings a child can change without a linked parent.
ca-sb1119.child-protective-default-settings · Cal. Bus. & Prof. Code 21812(d)(3) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots open to children need a pre-release child-safety risk assessment, a published child safety policy and a report channel (California SB 1119)
From 2027-07-01, Business and Professions Code 21812(a) requires an operator, before making a new or substantially modified companion chatbot available in California, to perform and document a risk assessment of its design, configuration and operation for child users: a summary of the results of any evaluation of each covered harm (physical or financial harm, severe psychological or emotional harm, highly offensive privacy intrusion, unlawful discrimination; 21810.5(g)), a high-level methodology citing the public benchmarks and research consulted, a description of any non-benchmark evaluations (or a justification if only benchmarks were used) and of any child-safety experts consulted, and documented measures that reasonably mitigate each identified child safety risk. An operator that permits child users must publish and keep accurate a child safety policy (21812(c)) describing how the chatbot is designed to prevent and respond to covered harms and how it meets the age-assurance, data and advertising, default settings and crisis, and conduct-prevention duties, and must offer a public incident reporting mechanism for third parties to report child safety risks directly to it (21812(d)(7)). Detect a companion product with no risk-assessment record, no published child safety policy or no incident-reporting channel.
ca-sb1119.child-safety-risk-assessment-and-policy · Cal. Bus. & Prof. Code 21812(a) · official source · applies from 2027-07-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Companion chatbots need an independent child safety audit by 2029 and every two years, filed with the Attorney General and posted online (California SB 1119)
Business and Professions Code 21814 (the version operative because AB 1405 was chaptered and takes effect 2027-01-01) requires an operator to ensure an independent child safety audit of its companion chatbot on or before 2029-01-01 or before it first makes a companion chatbot publicly available, whichever is later, then every two years, and before releasing a substantial modification whose risk assessment shows increased child safety risk; one audit may cover comparable chatbots, and an audit for another law of substantially similar scope may be used (21814(a)(1)-(2)). The auditor gets the documentation it needs (kept for the deployment period plus five years; the operator may set security protocols) and reports on the operator's policies, mitigations and their testing, internal controls for 21812(d) and 21813, material deviations, and senior personnel responsible (21814(a)(3)-(4)); the operator keeps the unredacted report for the deployment period plus five years (21814(a)(5)). Within 30 business days of receiving the report it submits a summary with an officer's attestation to the Attorney General, and within 90 days posts a high-level summary on its website (21814(b)). Before 2032-01-01 the section does not apply to an operator with less than $500,000,000 gross revenue in the prior calendar year (21814(c)). Detect a covered operator with no audit engagement, signed report, Attorney General filing or posted summary.
ca-sb1119.independent-child-safety-audit · Cal. Bus. & Prof. Code 21814(a) (AB 1405 version) · official source · applies from 2029-01-01 · jurisdictions: US-CA
Binding law — not yet in force or stayed
Parents of child users need controls over each default and access, promoted and easy to find, with no dark patterns (California SB 1119)
From 2027-07-01, an operator that permits child users must offer parental controls that let a parent adjust each protective default setting and disable access for a child under 16 (Business and Professions Code 21812(d)(3)(B)), actively promote those controls through reminders, updates and tutorials (21812(d)(3)(C)), and design the interface so children and parents can reasonably find, understand and use the safety features and controls (21812(d)(6)(A)), testing that design with representative samples of children and parents on or before 2028-01-01 and every two years after, and documenting the related design decisions (21812(d)(6)(B)). It may not use a dark pattern in the interface for those features and controls (21813(a)(2)(C)). Detect a companion product with no parent link and parental controls, no way for a parent to disable access, or no record of the interface testing.
ca-sb1119.parental-controls-and-safety-interface · Cal. Bus. & Prof. Code 21812(d)(3) · official source · applies from 2027-07-01 · jurisdictions: US-CA