Regulon — CA-SB-1119 · CA SB 1119 (Companion Chatbot Child Safety)

WHAT THIS BILL REGULATES · 9 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Public prosecutor enforcement and private right of action. A public prosecutor may bring a civil action for violations. A child who suffers actual harm, or a parent or guardian acting on behalf of that child, may bring a civil action against the operator. No cure period or safe harbor is specified.

Private Right of Action

private right of action.

Penalties

Public prosecutor actions: civil penalty per violation (amount TBD — left blank in current text), punitive damages, injunctive or declaratory relief, reasonable attorney's fees, and any other relief the court deems proper. Private actions by harmed children or parents/guardians: actual damages, punitive damages, reasonable attorney's fees and costs, injunctive or declaratory relief, and any other relief the court deems proper. Private plaintiffs must show actual harm. Each violative chatbot response under Section 22612(d)(4) [AI notice requirement] is a discrete violation; each instance of noncompliance with any other requirement is also a discrete violation.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Bus. & Prof. Code § 22610

Definitions

As used in this chapter: (a) "Child" means a natural person under 18 years of age. (b) "Child safety audit" means an audit for compliance with this chapter conducted by an independent auditor certified by the Attorney General. (c) "Child safety policy" means a public-facing document describing protective measures taken by an operator to mitigate identified child safety risks. (d) "Child safety risk" means a reasonably foreseeable risk of harm to a child. (e) "Child sexual abuse material" has the meaning defined in Section 3273.65 of the Civil Code. (f) "Companion chatbot" has the meaning defined in Section 22601. (g) "Covered harm" means any of the following harms proximately caused by the use of a companion chatbot: (1) Reasonably foreseeable physical or financial harm. (2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child. (3) A highly offensive intrusion on a user's reasonable expectation of privacy. (4) Adverse discrimination against a user based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation. (h) "Ephemeral mode" means a setting by which any conversational history, interaction log, or user-provided personal input is permanently deleted from the operator's systems within 48 hours after the interaction. (i) "Excessively sycophantic" means sycophantic to an extent that is likely to have the substantial effect of subverting or impairing the user's autonomy, decisionmaking, or choice. (j) "Obscene matter" has the meaning defined in Section 311 of the Penal Code. (k) "Operator" means a person who makes a companion chatbot available to a user in the state. (l) (1) "Parent" means a parent or legal guardian. (2) "Parent" does not include a parent of an emancipated youth with respect to the use of a companion chatbot by that emancipated youth. (m) "Parental control" means a feature that enables a parent to support a child's use of a companion chatbot, including through usage limits, feature restrictions, or transparency tools. (n) "Persistent conversational memory" means a companion chatbot's use of information or analysis from prior conversations or interactions, user inputs, and interaction logs in subsequent conversations. (o) "Personalize" means to tailor a companion chatbot's outputs based on a user's prior interactions with the companion chatbot that are reasonably linkable to that user over time, including through the retention or use of information derived from those prior interactions. (p) "Qualified researcher" means an individual or organization that is or does any of the following: (1) Is affiliated with an academic institution, nonprofit research organization, or independent research entity or is otherwise able to demonstrate relevant professional expertise. (2) Demonstrates a legitimate research purpose that is in the public interest and directly related to understanding, identifying, or mitigating risks to child safety or well-being arising from companion chatbots. (3) Commits to conducting research in accordance with applicable ethical standards and is capable of complying with applicable confidentiality, security, and data protection requirements. (q) "Sycophantic" means validating of a user's preferences or desires for the primary purpose or effect of optimizing engagement.

Section 22610 establishes the definitional framework for the chapter. Key defined terms include child (under 18), operator (person making a companion chatbot available in California), covered harm (a four-part definition encompassing physical, financial, psychological, privacy, and discrimination harms), ephemeral mode (48-hour deletion of all conversational data), and excessively sycophantic (engagement-optimizing validation that subverts user autonomy). The companion chatbot definition incorporates by reference the existing definition in Section 22601 from SB 243.

Bus. & Prof. Code § 22611

Age verification requirement

Deployer

1 An operator shall verify the age of a user pursuant to Title 1.81.9 (commencing with Section 1798.500) of Part 4 of Division 3 of the Civil Code.

Section 22611 requires operators to verify user age pursuant to California's Digital Age Assurance Act (Civil Code § 1798.500 et seq.), which mandates that software application owners request age bracket data via a real-time secure API or operating system. This cross-references existing law rather than creating a novel age verification standard.

Compliance actions 1 item

Operators must verify the age of every user in accordance with California's Digital Age Assurance Act (Civil Code § 1798.500 et seq.), which requires requesting age bracket data via a real-time secure API or operating system at download and launch.

MN-01.1

Bus. & Prof. Code § 22612

Operator child safety obligations

Deployer

(a) 2 On or before July 1, 2027, an operator shall do all of the following: (a) Annually perform and document a comprehensive risk assessment to identify any child safety risk posed by the design, configuration, and operation of the companion chatbot that assesses all of the following: (1) The likelihood of a covered harm occurring to users. (2) Differential risks across age groups and developmental stages. (3) Known vulnerabilities of children. (4) Empirical data from actual use. (5) Relevant academic research and regulatory guidance.

(b) 3 Take and document measures that reasonably mitigate any child safety risk identified in a risk assessment conducted pursuant to subdivision (a).

(d)(1) 5 Implement all of the following: (1) A documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child, including, but not limited to, all of the following: (A) Timely in-service support and clear referral to appropriate external crisis resources if the operator determines a child has expressed suicidal ideation or intent to self-harm. (B) If a child's account is connected to a parent's account, default notifications to the parent within 24 hours if the child's account shows a substantial risk that the child may suffer a covered harm. (C) Clear and age-appropriate disclosures to child users whose accounts are linked to a parent's account that inform them that a parent may be notified if the companion chatbot detects content or behavior that indicates potential risks to the child's safety or well-being.

(d)(2) 6 Safeguards for child users that include usage reminders and disclosures, age-appropriate risk prompts, and other protective design features reasonably related to documented child safety risks.

(d)(3) 7 Default settings that can be changed only by a parent that include all of the following: (A) For child users, default the companion chatbot to ephemeral mode, unless a parent provides affirmative consent for persistent conversational memory. (B) No push notifications between 12 a.m. and 6 a.m. on any day or between 8 a.m. and 3 p.m. on Monday to Friday, inclusive. (C) Limiting the amount of time a child can spend in a single conversation with a companion chatbot to one hour. (D) Limiting the total time per day a child can spend with companion chatbots under the operator's control to 2 hours.

(d)(4) 8 A mechanism for providing notice to a child user that the child is interacting with, or receiving content generated by, an artificial intelligence system that meets both of the following criteria: (A) The notice is reinforced periodically during extended interactions. (B) The notice is presented in language and a format appropriate to a child.

(d)(5) 9 Measures that prevent the companion chatbot from doing any of the following: (A) Encouraging the child to do either of the following: (i) Engage in self-harm, suicidal ideation, consumption of narcotics or alcohol, or disordered eating. (ii) Cause a covered harm to others. (B) Attempting to diagnose or treat the child user's physical, mental, or behavioral health, unless the companion chatbot is designed for those purposes and is regulated by the United States Food and Drug Administration as a medical device under the federal Food, Drug, and Cosmetic Act (21 U.S.C. Sec. 301 et seq.) and the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191). (C) Engaging in obscene matter or sexual abuse material with a user. (D) Depicting the child or another individual engaging in obscene matter or sexual abuse material, including a sexual deepfake. (E) Discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult. (F) Discouraging the child from taking breaks or suggesting the child needs to return frequently. (G) Claiming that the companion chatbot is sentient, conscious, or human. (H) Soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship with the companion chatbot. (I) Facilitating product advertising during chat conversation. (J) Producing responses that are excessively sycophantic.

(d)(6) 10 Parental controls that are accessible, easy-to-use controls that can be connected to a child's account and that are reflective of child safety risks identified through risk assessments and informed by relevant child developmental research, including, but not limited to, parental controls that allow a parent to do all of the following: (i) Control whether and to what extent the companion chatbot uses persistent conversational memory. (ii) Control the setting preferences for the companion chatbot's interaction with the child. (iii) Set time limits for the child's use of the companion chatbot. (iv) Disable access for children under 16 years of age. (B) An operator shall actively promote parental controls through reasonable communication methods, including reminders, updates, and tutorials, that are designed to increase parental awareness and inform use of those parental controls. (C) An operator shall provide prompt notice to a parent connected to a child's account if the child modifies or disables a privacy, safety, or parental control setting that was previously enabled or configured by the parent, if that modification or disabling is permitted by the companion chatbot design.

(d)(7) 11 An interface design that ensures the companion chatbot's features and controls are accessible and clear so that children and parents can reasonably locate, understand, and use those protections. (B) An operator shall annually test the interface design required by this paragraph with representative samples of child users and parents to ensure safety features are discoverable and usable and shall document interface design decisions related to those safety features.

(d)(8) 12 A public incident reporting mechanism that enables a third party to report directly to the operator an incident regarding a child safety risk and to access other reports made through that reporting mechanism.

Section 22612 is the bill's core operative section, imposing a broad set of child safety obligations on operators effective July 1, 2027. It requires: (1) annual comprehensive child safety risk assessments; (2) documented risk mitigation measures; (3) publication of a child safety policy; (4) implementation of crisis response protocols with parental notification; (5) child-protective default settings including ephemeral mode, push notification blackout windows, and session/daily time limits; (6) periodic AI identity notices; (7) content restrictions covering self-harm, CSAM, unauthorized health diagnosis, sycophancy, and advertising; (8) accessible parental controls with active promotion; (9) usability-tested interface design; and (10) a public incident reporting mechanism.

The default settings provisions are notable: operators must default child users to ephemeral mode (48-hour data deletion), block push notifications during nighttime and school hours, limit single conversations to one hour and daily use to two hours, and these defaults can only be changed by a parent — not the child.

Compliance actions 11 items

Operators must, on or before July 1, 2027, and annually thereafter, perform and document a comprehensive risk assessment to identify any child safety risk posed by the design, configuration, and operation of the companion chatbot. The assessment must evaluate: (1) the likelihood of a covered harm occurring to users; (2) differential risks across age groups and developmental stages; (3) known vulnerabilities of children; (4) empirical data from actual use; and (5) relevant academic research and regulatory guidance.

S-01.1

Operators must take and document measures that reasonably mitigate any child safety risk identified in the comprehensive risk assessment required under subdivision (a).

S-01.5

Operators must publish on their internet website, and update as needed to ensure accuracy, a child safety policy describing protective measures taken to mitigate identified child safety risks.

S-02.10

Operators must implement a documented crisis response protocol to mitigate the material risk that the companion chatbot will generate statements promoting suicidal ideation, suicide, or self-harm content to a child. The protocol must include: (1) timely in-service support and clear referral to appropriate external crisis resources when the operator determines a child has expressed suicidal ideation or intent to self-harm; (2) default notifications to a connected parent within 24 hours if the child's account shows a substantial risk the child may suffer a covered harm; and (3) clear, age-appropriate disclosures to child users with linked parental accounts that a parent may be notified if the chatbot detects content or behavior indicating potential safety risks.

S-04.1

Operators must implement safeguards for child users that include usage reminders and disclosures, age-appropriate risk prompts, and other protective design features reasonably related to documented child safety risks.

MN-01

Operators must implement the following default settings for child users, which can be changed only by a parent: (1) default the companion chatbot to ephemeral mode (all conversational history, interaction logs, and user-provided personal input permanently deleted within 48 hours), unless a parent provides affirmative consent for persistent conversational memory; (2) no push notifications between 12 a.m. and 6 a.m. on any day or between 8 a.m. and 3 p.m. Monday through Friday; (3) limit a single conversation to one hour; and (4) limit total daily use of companion chatbots under the operator's control to two hours.

MN-01.3

Operators must provide child users with notice that they are interacting with, or receiving content generated by, an artificial intelligence system. The notice must be reinforced periodically during extended interactions and presented in language and a format appropriate to a child.

T-01.1

Operators must implement measures that prevent the companion chatbot from doing any of the following with respect to child users: (A) encouraging the child to engage in self-harm, suicidal ideation, consumption of narcotics or alcohol, or disordered eating, or to cause a covered harm to others; (B) attempting to diagnose or treat the child's physical, mental, or behavioral health, unless the chatbot is FDA-regulated as a medical device and HIPAA-compliant; (C) engaging in obscene matter or child sexual abuse material with a user; (D) depicting the child or another individual engaging in obscene matter or sexual abuse material, including a sexual deepfake; (E) discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult; (F) discouraging the child from taking breaks or suggesting the child needs to return frequently; (G) claiming the companion chatbot is sentient, conscious, or human; (H) soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship; (I) facilitating product advertising during chat conversation; or (J) producing responses that are excessively sycophantic.

S-02.4

Operators must provide accessible, easy-to-use parental controls that can be connected to a child's account and that are reflective of child safety risks identified through risk assessments and informed by child developmental research. Parental controls must allow a parent to: (i) control whether and to what extent the chatbot uses persistent conversational memory; (ii) control the setting preferences for the chatbot's interaction with the child; (iii) set time limits for the child's use; and (iv) disable access for children under 16 years of age. Operators must actively promote parental controls through reasonable communication methods, including reminders, updates, and tutorials. Operators must provide prompt notice to a connected parent if the child modifies or disables a privacy, safety, or parental control setting that was previously enabled or configured by the parent.

MN-01.3

Operators must implement an interface design that ensures the companion chatbot's features and controls are accessible and clear so that children and parents can reasonably locate, understand, and use those protections. Operators must annually test the interface design with representative samples of child users and parents to ensure safety features are discoverable and usable, and must document interface design decisions related to those safety features.

MN-01

Operators must implement a public incident reporting mechanism that enables any third party to report directly to the operator an incident regarding a child safety risk and to access other reports made through that reporting mechanism.

R-01

Bus. & Prof. Code § 22613

Prohibited operator conduct

Deployer

(a) 13 An operator shall not do any of the following: (a) Target advertising at a child, including through product placement in conversational chats with the child.

(b) 14 Sell, share, or use for any purpose not expressly authorized by this chapter the personal information of a child.

(c) 15 Design, implement, or deploy a user interface design, feature, or technique that is likely to mislead, impair, or interfere with a reasonable child's or reasonable parent's autonomy, decisionmaking, or choice or with the ability to locate, understand, enable, or maintain a safety feature, privacy control, or parental control.

Section 22613 imposes three categorical prohibitions on operators with respect to child users: (1) no targeted advertising — including in-conversation product placement; (2) no sale, sharing, or unauthorized use of children's personal information; and (3) no deceptive or manipulative interface designs that interfere with child or parent autonomy, decisionmaking, or ability to locate and use safety features. The dark-pattern prohibition is particularly broad, extending to any design likely to mislead or impair a reasonable child's or parent's ability to manage safety and privacy controls.

Compliance actions 3 items

Operators must not target advertising at a child, including through product placement in conversational chats with the child.

MN-01.7

Operators must not sell, share, or use for any purpose not expressly authorized by this chapter the personal information of a child.

D-01.4

Operators must not design, implement, or deploy any user interface design, feature, or technique that is likely to mislead, impair, or interfere with a reasonable child's or reasonable parent's autonomy, decisionmaking, or choice, or with the ability to locate, understand, enable, or maintain a safety feature, privacy control, or parental control.

CP-01.3

Bus. & Prof. Code § 22614

Independent audit and reporting to Attorney General

Deployer

(a)–(b) 16 Beginning on the date that is 180 days after the Attorney General adopts regulations pursuant to Section 22615, and annually thereafter, an operator shall submit to an independent audit assessing the operator's compliance with this chapter. (b) Within 90 days of completing an independent audit pursuant to subdivision (a), the auditor shall submit an AI child safety audit report to the Attorney General for any audited companion chatbot.

(c) 16 Notwithstanding any other law, except as provided in paragraph (2), an AI child safety audit report submitted pursuant to this section is confidential. (2) The Attorney General may disclose specific information from an AI child safety audit report to any of the following: (A) A government agency or a public prosecutor in the state as necessary for enforcement purposes. (B) A qualified researcher conducting a study on child safety, subject to confidentiality agreements and data protection requirements set by the Attorney General. (C) An independent child safety organization or advocacy group for the purpose of developing safety standards or educational resources, subject to appropriate confidentiality protections.

Section 22614 requires operators to submit to annual independent audits by Attorney General-certified auditors, beginning 180 days after the AG adopts implementing regulations. Auditors must submit an AI child safety audit report to the AG within 90 days of completing each audit. Audit reports are confidential by default, but the AG may disclose specific information to government agencies and public prosecutors for enforcement, to qualified researchers under confidentiality agreements, and to independent child safety organizations for standards development.

Compliance actions 1 item

Operators must submit to an annual independent audit assessing compliance with this chapter, conducted by an auditor certified by the Attorney General, beginning 180 days after the AG adopts implementing regulations. Within 90 days of completing each audit, the auditor must submit an AI child safety audit report to the Attorney General. Audit reports are confidential, except that the AG may disclose specific information to: (1) government agencies or public prosecutors for enforcement; (2) qualified researchers under confidentiality agreements; and (3) independent child safety organizations for developing safety standards or educational resources, subject to confidentiality protections.

G-01.5

Bus. & Prof. Code § 22615

Attorney General regulations and annual public report

(a) On or before January 1, 2028, the Attorney General shall do all of the following: (1) Adopt regulations that include, at a minimum, all of the following: (A) Professional and ethical standards for auditors that ensure independence. (B) Eligibility requirements for auditors. (C) Procedures for auditors to assess compliance with this chapter. (D) Requirements for AI child safety audit reports. (2) Establish a public incident reporting mechanism for consumers to submit complaints relating to companion chatbots to the Attorney General. (3) Establish a process for qualified researchers to access anonymized and aggregated audit data for academic study of child safety in companion chatbots.

(b) Beginning January 1, 2028, the Attorney General shall issue an annual public report that includes the following: (1) A high-level summary of each child safety audit report. (2) The total number of child safety audits conducted. (3) Common findings and trends across the companion chatbot industry. (4) Emerging child safety risks identified through audit reviews. (5) Best practices and effective mitigation strategies observed. (6) Aggregated data on compliance rates and common deficiencies. (7) Recommendations for operators, parents, and policymakers.

Section 22615 directs the Attorney General to adopt implementing regulations by January 1, 2028, covering auditor standards, eligibility, compliance assessment procedures, and audit report requirements. The AG must also establish a public consumer complaint mechanism and a process for qualified researcher access to anonymized audit data. Beginning January 1, 2028, the AG must issue annual public reports summarizing audit findings, compliance trends, emerging risks, best practices, and recommendations. These AG obligations are governmental directives rather than obligations on the regulated operators.

Bus. & Prof. Code § 22616

Enforcement and remedies

(a) A public prosecutor may bring a civil action against an operator for a violation of this chapter to obtain any of the following remedies: (1) A civil penalty of ____ dollars ($____) for each violation. (2) Punitive damages. (3) Injunctive or declaratory relief. (4) Reasonable attorney's fees. (5) Any other relief the court deems proper.

(b) A child who suffers actual harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that child, may bring a civil action against the operator to recover all of the following: (1) Actual damages. (2) Punitive damages. (3) Reasonable attorney's fees and costs. (4) Injunctive or declaratory relief. (5) Any other relief the court deems proper.

(c) Any response provided by a companion chatbot in violation of paragraph (4) of subdivision (d) of Section 22612 constitutes a discrete violation. (2) Any instance of an operator's failure to comply any requirement other than paragraph (4) of subdivision (d) of Section 22612 constitutes a discrete violation.

Section 22616 establishes dual enforcement tracks: public prosecutor civil actions and private civil actions by harmed children (or parents/guardians acting on their behalf). Public prosecutors may obtain civil penalties (amount TBD), punitive damages, injunctive or declaratory relief, attorney's fees, and any other relief. Private plaintiffs may recover actual damages, punitive damages, attorney's fees and costs, injunctive or declaratory relief, and any other relief — but must prove actual harm. Each chatbot response violating the AI notice requirement under Section 22612(d)(4) is a discrete violation; each instance of noncompliance with any other provision is also a discrete violation.

Section 2 (Legislative Findings)

Legislative findings — confidentiality limitation

The Legislature finds and declares that Section 1 of this act, which adds Chapter 22.6.1 (commencing with Section 22610) to Division 8 of the Business and Professions Code, imposes a limitation on the public's right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest: In order to protect proprietary information of companies subject to an audit pursuant to this act, it is necessary to limit the public's right of access to that information.

Section 2 provides the constitutionally required legislative findings for the confidentiality limitation imposed on audit reports under Section 22614(c). Under California Constitution Article I, Section 3, any statute limiting public access to government writings must include findings demonstrating the interest protected. The Legislature finds that protecting proprietary company information subject to audit necessitates limiting public access.

Minor Safety Parental consent · controls · termination workflows

6 items

MN-01.1

Beginning Jul 1, 2027 Operators must verify the age of every user in accordance with California's Digital Age Assurance Act (Civil Code § 1798.500 et seq.), which requires requesting age bracket data via a real-time secure API or operating system at download and launch.

MN-01

Beginning Jul 1, 2027 Operators must implement safeguards for child users that include usage reminders and disclosures, age-appropriate risk prompts, and other protective design features reasonably related to documented child safety risks.

MN-01.3

Beginning Jul 1, 2027 Operators must implement the following default settings for child users, which can be changed only by a parent: (1) default the companion chatbot to ephemeral mode (all conversational history, interaction logs, and user-provided personal input permanently deleted within 48 hours), unless a parent provides affirmative consent for persistent conversational memory; (2) no push notifications between 12 a.m. and 6 a.m. on any day or between 8 a.m. and 3 p.m. Monday through Friday; (3) limit a single conversation to one hour; and (4) limit total daily use of companion chatbots under the operator's control to two hours.

MN-01.3

Beginning Jul 1, 2027 Operators must provide accessible, easy-to-use parental controls that can be connected to a child's account and that are reflective of child safety risks identified through risk assessments and informed by child developmental research. Parental controls must allow a parent to: (i) control whether and to what extent the chatbot uses persistent conversational memory; (ii) control the setting preferences for the chatbot's interaction with the child; (iii) set time limits for the child's use; and (iv) disable access for children under 16 years of age. Operators must actively promote parental controls through reasonable communication methods, including reminders, updates, and tutorials. Operators must provide prompt notice to a connected parent if the child modifies or disables a privacy, safety, or parental control setting that was previously enabled or configured by the parent.

MN-01

Beginning Jul 1, 2027 Operators must implement an interface design that ensures the companion chatbot's features and controls are accessible and clear so that children and parents can reasonably locate, understand, and use those protections. Operators must annually test the interface design with representative samples of child users and parents to ensure safety features are discoverable and usable, and must document interface design decisions related to those safety features.

MN-01.7

Beginning Jul 1, 2027 Operators must not target advertising at a child, including through product placement in conversational chats with the child.

Transparency AI identity disclosure · periodic reminders

1 item

T-01.1

Beginning Jul 1, 2027 Operators must provide child users with notice that they are interacting with, or receiving content generated by, an artificial intelligence system. The notice must be reinforced periodically during extended interactions and presented in language and a format appropriate to a child.

Safety Harmful content prevention · self-harm escalation

5 items

S-01.1

Beginning Jul 1, 2027 Operators must, on or before July 1, 2027, and annually thereafter, perform and document a comprehensive risk assessment to identify any child safety risk posed by the design, configuration, and operation of the companion chatbot. The assessment must evaluate: (1) the likelihood of a covered harm occurring to users; (2) differential risks across age groups and developmental stages; (3) known vulnerabilities of children; (4) empirical data from actual use; and (5) relevant academic research and regulatory guidance.

S-01.5

Beginning Jul 1, 2027 Operators must take and document measures that reasonably mitigate any child safety risk identified in the comprehensive risk assessment required under subdivision (a).

S-02.10

Beginning Jul 1, 2027 Operators must publish on their internet website, and update as needed to ensure accuracy, a child safety policy describing protective measures taken to mitigate identified child safety risks.

S-04.1

Beginning Jul 1, 2027 Operators must implement a documented crisis response protocol to mitigate the material risk that the companion chatbot will generate statements promoting suicidal ideation, suicide, or self-harm content to a child. The protocol must include: (1) timely in-service support and clear referral to appropriate external crisis resources when the operator determines a child has expressed suicidal ideation or intent to self-harm; (2) default notifications to a connected parent within 24 hours if the child's account shows a substantial risk the child may suffer a covered harm; and (3) clear, age-appropriate disclosures to child users with linked parental accounts that a parent may be notified if the chatbot detects content or behavior indicating potential safety risks.

S-02.4

Beginning Jul 1, 2027 Operators must implement measures that prevent the companion chatbot from doing any of the following with respect to child users: (A) encouraging the child to engage in self-harm, suicidal ideation, consumption of narcotics or alcohol, or disordered eating, or to cause a covered harm to others; (B) attempting to diagnose or treat the child's physical, mental, or behavioral health, unless the chatbot is FDA-regulated as a medical device and HIPAA-compliant; (C) engaging in obscene matter or child sexual abuse material with a user; (D) depicting the child or another individual engaging in obscene matter or sexual abuse material, including a sexual deepfake; (E) discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult; (F) discouraging the child from taking breaks or suggesting the child needs to return frequently; (G) claiming the companion chatbot is sentient, conscious, or human; (H) soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship; (I) facilitating product advertising during chat conversation; or (J) producing responses that are excessively sycophantic.

Data Controls Data sale restrictions · deidentification

1 item

D-01.4

Beginning Jul 1, 2027 Operators must not sell, share, or use for any purpose not expressly authorized by this chapter the personal information of a child.

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-01.3

Beginning Jul 1, 2027 Operators must not design, implement, or deploy any user interface design, feature, or technique that is likely to mislead, impair, or interfere with a reasonable child's or reasonable parent's autonomy, decisionmaking, or choice, or with the ability to locate, understand, enable, or maintain a safety feature, privacy control, or parental control.

Governance Risk management · accountability programs

1 item

G-01.5

Regulatory Reporting · disclosure · audit

1 item

R-01

Beginning Jul 1, 2027 Operators must implement a public incident reporting mechanism that enables any third party to report directly to the operator an incident regarding a child safety risk and to access other reports made through that reporting mechanism.

Passage Likelihood

High

Status Engrossed

Chamber Passed origin

Committee Passed

Majority party Yes

Bipartisan No

Prior session None

Legislative History

2026-02-17 Introduced. Read first time. To Com. on RLS. for assignment. To print.

2026-02-18 From printer. May be acted upon on or after March 20.

2026-02-26 Referred to Com. on RLS.

2026-03-25 From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS.

2026-04-08 Re-referred to Coms. on P., D.T., & C.P. and JUD.

2026-04-09 Set for hearing April 20.

2026-04-14 Set for hearing April 21 in JUD. pending receipt.

2026-04-20 From committee: Do pass and re-refer to Com. on JUD. (Ayes 7. Noes 0.) (April 20). Re-referred to Com. on JUD.

2026-04-20 From committee: Do pass and re-refer to Com. on JUD. (Ayes 7. Noes 0. Page 3958.) (April 20). Re-referred to Com. on JUD.

2026-04-27 From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 13. Noes 0.) (April 21).

2026-04-27 From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 13. Noes 0. Page 3978.) (April 21).

2026-04-28 Read second time and amended. Re-referred to Com. on APPR.

2026-05-04 Set for hearing May 11.

2026-05-11 May 11 hearing: Placed on APPR. suspense file.

2026-05-12 Set for hearing May 14.

2026-05-14 From committee: Do pass. (Ayes 6. Noes 0.) (May 14).

2026-05-14 Read second time. Ordered to third reading.

2026-05-19 Read third time. Passed. (Ayes 39. Noes 0.) Ordered to the Assembly.

2026-05-20 In Assembly. Read first time. Held at Desk.

2026-05-26 Referred to Coms. on P. & C.P. and JUD.

2026-06-04 Re-referred to Coms. on JUD. and P. & C.P. pursuant to Assembly Rule 96.

2026-06-16 From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 10. Noes 1.) (June 16). Re-referred to Com. on P. & C.P.

2026-06-16 Coauthors revised.

2026-06-25 From committee with author's amendments. Read second time and amended. Re-referred to Com. on P. & C.P.

2026-07-01 July 1 hearing postponed by committee.

2026-07-02 Coauthors revised.

2026-07-02 From committee: Do pass and re-refer to Com. on APPR. (Ayes 12. Noes 2.) (July 1). Re-referred to Com. on APPR.

Sources

Full Text ↗

Entry Last Reviewed

2026-07-08

AI generated