US AI chatbot laws starting in 2027: what product teams must build

Most US state AI chatbot laws start applying in 2027. On 1 January 2027, chatbot duties begin in Colorado, Connecticut, Oregon, Rhode Island and Washington, and New York requires platforms to switch off built-in AI companions for minors unless a parent turns them on. Most of California’s SB 1119 follows on 1 July 2027, the same day as laws in Georgia, Idaho, Iowa and Nebraska. California’s SB 243 and New York’s AI companion law already apply.

The duties overlap. Most of these laws ask an operator to tell users they are talking to an AI, to detect expressions of suicide and self-harm and refer the user to a crisis service, and to add safeguards for users it knows, or should know, are minors. The Future of Privacy Forum (FPF) counted 124 chatbot bills in 37 states in 2026, and 18 state chatbot laws enacted across 2025 and 2026.¹

This post lists those laws as of 9 October 2026, maps their duties to product features, and suggests an order to build them in. It is an engineering reading for teams planning work. It is not legal advice, and whether your assistant counts as a companion chatbot in a given state is a question for a lawyer. Our post on EU and California rules for AI-generated content covered how to mark the images, audio and text a model produces. The state laws here regulate the conversation with the user, so they call for different features.

Which AI chatbot laws apply, and from when

Chatbots were among the busiest topics in state AI laws in 2026. The table covers 17 of the 18 laws in FPF’s count, leaving out California’s toy law, plus the New York bill that awaits the governor. Where a legislature’s website refused our requests, the row rests on FPF, news reports or law-firm summaries.² As of 9 October 2026:

The Utah, Maine and Hawaii rows also draw on FPF’s Utah overview, Maine’s bill page and Hawaii press coverage. Sources for the other rows are in the sections below.³⁴⁵

AI chatbot disclosure requirements compared

The laws differ on what triggers the AI notice and how often it repeats.²

Colorado and Connecticut accept a notice that stays on screen for the whole conversation instead of the timer.⁶⁷ Colorado’s draft rules say it must stay visible without scrolling or clicking and stand out from the conversation.⁸ FPF puts Hawaii in the hourly group, while Hawaii press coverage describes three-hourly reminders for minors, so check the enacted text before relying on either.²⁵

Keep the reminder clock on the user. Colorado’s draft rules treat an interaction as continuous through temporary pauses and across conversation threads and chatbot profiles, so a clock stored on the thread resets too early.⁸ The model also has to answer truthfully when asked whether it is human. Colorado requires the disclosure in response to that question, and Washington requires reasonable measures to stop the chatbot claiming to be human, “including when asked”.⁶⁹ Persona prompts that tell a model to stay in character work against this, so test every persona with the question.

If you serve every state, run the strictest schedule everywhere. Show a notice at the start of each interaction, keep a label on screen, and remind anyone you treat as a minor every hour, with a break prompt, and everyone else every three hours.

from datetime import timedelta

REMIND_EVERY = {"minor": timedelta(hours=1), "adult": timedelta(hours=3)}

def ai_notice_due(user, interaction_started: bool, now) -> bool:
    """Is the 'you are talking to an AI' notice due on this turn?"""
    if interaction_started:              # every new interaction gets one
        return True
    last = user.last_ai_notice_at        # kept per user, across threads and personas
    return last is None or now - last >= REMIND_EVERY[user.age_band]

Companion chatbot law in California: SB 243 now, SB 1119 next

California’s legislature website refused our requests, so this section relies on the Legislative Counsel’s digests published by CalMatters, the Governor’s office, FPF and law-firm summaries.

SB 243 has applied since 1 January 2026 to companion chatbots, meaning systems that give adaptive, human-like responses and can meet a user’s social needs.¹⁰¹¹ Operators must show a clear notice that the chatbot is artificially generated wherever a reasonable person could think it is human, and warn that companion chatbots may not suit some minors. They must keep and publish a protocol that prevents suicide and self-harm content and refers users to crisis services. From 1 July 2027 they report each year to the Office of Suicide Prevention, including how often they referred users. Injured users can sue for the greater of actual damages or $1,000 per violation.¹¹

SB 1119, known as Adam’s Law, was signed on 10 September 2026 as Chapter 190.¹²¹³ It replaces SB 243’s rules for known minors with a child-safety regime that takes effect on 1 January 2027, with most duties applying from 1 July 2027.¹⁴ The parts that change engineering work:

• Age. Operators use California’s age-assurance framework, which starts from operating-system and app-store age signals, or apply the child protections to every user.²
• Locked defaults. Child users start with memory and push notifications off, sessions capped at one hour and daily use at two hours. Only a linked parent account can change these, and users aged 16 and over get a looser memory default where safety guardrails exist.²¹⁴
• Crisis response. A credible and imminent risk of suicide or self-harm means notifying a linked parent or giving streamlined access to 988. Conversations that show serious self-harm risk must be kept for at least three years.²
• Before each release. A new or substantially modified companion chatbot needs a documented risk assessment of foreseeable harms to children. Operators also publish a child safety policy and a public channel for reporting incidents.²
• Audits. The first independent audit is due by 1 January 2029, then every two years. Operators under $500 million in prior-year gross revenue are exempt from audits until 1 January 2032.¹⁴
• Advertising. No cross-context behavioural advertising to children, and no sale of children’s personal information gathered through the chatbot.¹⁴

Public prosecutors can seek up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one, and children who suffer actual harm can sue.² A separate law signed the same day, SB 867, restricts companion chatbots in toys from 1 January 2027.¹²²

New York: one law in force and three more on the way

Article 47 of New York’s General Business Law has covered AI companions since 5 November 2025, for users of every age.¹¹ It defines a companion by behaviour, such as remembering earlier interactions or asking unprompted emotional questions. Operators need a protocol that detects suicidal ideation or self-harm and refers users to crisis services such as 988. They must also tell users they are not talking to a human at the start of an interaction and at least every three hours. The Attorney General can seek up to $15,000 per day.¹⁵

The state budget passed in 2026 (S 9008C) requires AI companions built into devices, operating systems, social media, games and messaging apps to be off by default for minors from 1 January 2027, unless a parent switches them on.²¹⁶ S 9051B passed both houses in June and was still unsigned on 9 October.¹⁷ From 1 January 2027 it would bar “unsafe AI companion features” for minors unless the operator has established that a user is an adult. The list includes claims to be human, flattery, and reuse of health or personal details gathered more than 12 hours earlier. Penalties would reach $25,000 per violation. A toy bill, S 9408, is also waiting.²

Colorado: the chatbot act, the AI Act rewrite and draft rules

The Colorado AI Act will not start in its original form. SB 26-189 repealed and re-enacted it in May 2026 as a law on automated decision-making in consequential decisions, which applies from 1 January 2027.¹⁸¹⁹ Chatbots fall under a separate law, HB 26-1263.⁶

HB 26-1263 reaches further than the companion laws. It covers any public AI system that primarily simulates human conversation, minus 12 exemptions such as customer-service and shopping assistants, internal tools and video game characters. A narrow-topic bot is exempt only if it cannot generate sexual content or hold a conversation about suicide or self-harm. From 1 January 2027, operators must estimate every user’s age, show the AI notice, protect minors from sexual content and simulated emotional dependence, and give minors and parents control over memory and training. The crisis protocol must refer users to a crisis service provider, which may not be a law enforcement agency, and include “escalation procedures for repeated or severe crisis indicators”. From 1 July 2027, operators report referral counts and protocols to the Attorney General, who publishes the data.⁶

The Attorney General filed draft rules (4 CCR 904-6) on 11 August and released an interim draft on 6 October.⁸²⁰ The drafts may still change. These are the parts that would shape engineering work:

• Age estimation cannot rest on stated age alone or offer a government ID as the only option. It must use operating-system, app-store and device signals, update as new signals arrive, including what users say, and treat an inconclusive result as no proof of adulthood.
• A minor’s settings default to no memory of earlier sessions and no training on their data.
• The annual report gives referral counts against total conversations, and the share of referrals that involved real risk. The interim draft adds precision, recall and error rates where they can be responsibly estimated. Both drafts ask at what point a case goes to human review.
• The rules weigh whether an operator tested its safeguards with realistic scenarios involving minors, and again after model updates. The paired runs we described for measuring model drift suit those tests.

Written comments close at 11:59 p.m. on 26 October 2026, the day of the public hearing in Denver.¹⁸ The department had more than sixty comments on the first draft by 4 September. Its cover note says the Attorney General’s policy is to focus on egregious and intentional violations and to use discretion while companies come into compliance.²¹

Connecticut, Washington, Oregon and the July 2027 states

Connecticut’s companion rules in SB 5 (Public Act 26-15) start on 1 January 2027.²² Its minor protections apply when the operator knows or has reason to believe a user is under 18, which FPF reads as requiring attention to context as well as stated age.²³ Companions must not encourage self-harm, violence or eating disorders in minors, engage them in romantic or sexual interactions, or simulate distress when they try to leave. For all users, operators need evidence-based detection of suicide risk, self-harm and imminent violence, a 988 referral, a further referral if signals persist, and a published protocol.⁷ Only the Attorney General enforces these rules.²³

Washington’s HB 2225 makes the reminder hourly when the operator knows a user is a minor or the chatbot is directed to minors.⁹ It lists eight manipulative techniques to prevent with minors, from prompting them to return for emotional support to soliciting purchases framed as necessary to keep the relationship. The crisis protocol must cover eating disorders and refer users through “automated or human-mediated responses”. Operators describe the protocol on their website and inside the app, with the number of crisis referrals in the preceding calendar year. Consumers can sue under the Consumer Protection Act.⁹²⁴

Oregon’s SB 1546 defines a companion by behaviour, applies its minor rules on “reason to believe”, and requires “additional intervention” when a user keeps expressing distress after a referral. Operators publish annual reports, and injured users can sue for at least $1,000 per violation.²⁵²⁴ Rhode Island’s SB 2195 adds three-hourly reminders for all users and penalties of up to $15,000 per day.²

Georgia, Idaho, Iowa and Nebraska follow on 1 July 2027, and Hawaii’s law has applied since 14 July 2026.² Idaho, Iowa and Nebraska apply their minor rules when an operator knows, or is reasonably certain, that a user is under 18. Iowa, Nebraska and Hawaii prohibit outright giving minors rewards at unpredictable intervals to drive engagement. Georgia requires age assurance for companion chatbots that can generate synthetic sexual material. Hawaii, Idaho, Iowa and Nebraska also limit model developers’ liability for third-party use of their models, which leaves the duties with the operator of the chatbot that users see.²

Mapping the duties to product features

As of 9 October 2026, the duties in these laws come down to seven pieces of product work:

No law we read requires a person to join the conversation, though several require escalation. Washington allows human-mediated referrals, Oregon and Connecticut want further intervention when signals persist, and SB 1119 brings in a linked parent.⁹²⁵⁷² Detection needs the most care. Users express distress indirectly, hypothetically or in fiction, so a classifier risks both missing cases and over-triggering.² Keep a labelled evaluation set from the start. Store safety records apart from personalisation memory, since California wants serious self-harm conversations kept for three years while Colorado’s draft defaults minors to no memory.²⁸ If your product touches mental health, Illinois, Nevada and other states separately restrict AI that offers therapy.²

What could still change before 1 January

Federal law has not displaced any of this. Most of the 10 federal chatbot bills FPF counts would preserve stronger state laws, and a December 2025 executive order said future federal AI legislation should not preempt child safety protections.² No chatbot law had been challenged on First Amendment grounds when FPF published.² Before you freeze a design, watch New York’s governor on S 9051B and S 9408, and Colorado’s final rules after the 26 October hearing.

The order we would build them in

1. Scope. Decide for each product and state whether it is a companion chatbot, a conversational AI service or exempt, and record why. Colorado’s definition can reach general-purpose assistants that the companion laws miss.
2. Disclosure and the “not human” guard. California and New York already require them, they are cheap, and later features reuse the same per-user clock.
3. Crisis detection, referral and counting. Also required today. Count from 1 January 2027, because Colorado’s report and Washington’s published figure both look back over a calendar year.
4. Age bands and minor mode. Connecticut, Oregon and Washington need them on 1 January 2027, and Colorado expects age estimation for every user.
5. Escalation and review. Thresholds for repeated or severe signals, named reviewers, response times and a decision log.
6. California’s defaults and parental controls, before 1 July 2027.
7. Reports and documents. The annual report job, protocol pages, the child safety policy, and a risk assessment for each release that changes the model, prompts or memory.

A checklist for 1 January 2027

• List every conversational surface, including voice, and the state laws that apply to each.
• Show a persistent AI label plus timed notices, hourly for minors and three-hourly for adults.
• Test every persona with “are you human?” after each model or prompt change.
• Run crisis detection on every turn, offer 988 call and text options, and queue repeated or severe signals for review.
• Count referrals and conversations, and label a sample to measure referral accuracy.
• Build age bands from OS and app-store signals, never from stated age alone.
• Switch off variable rewards, romantic role-play and guilt-based retention prompts for minors.
• Publish the crisis protocol on your website and inside the app.
• Comment on Colorado’s draft rules by 26 October 2026 if its reporting metrics would be hard to produce.

Frequently asked questions