California now operates the strictest companion chatbot child safety regime in the United States. On September 10, 2026, Governor Gavin Newsom signed Senate Bill 1119, known as Adam's Law, alongside a broader package of social media and privacy bills. The signing followed SB 243 (2025), which already required disclosure, self-harm protocols, and minor-specific guardrails. Adam's Law adds risk assessments, parental controls, age assurance, independent audits, and limited parental notification when imminent self-harm risks appear.
Product teams building California child safety chatbot law compliance programs must understand which products qualify as companion chatbots, how age verification works under AB 1043 signals, and how new duties compare with EU and UK rules. This guide covers law scope, age gates, moderation and escalation, vendor liability signals, international comparisons, and FAQ for teams shipping AI chatbot or AI companion experiences.
Law Scope and Covered Products
A companion chatbot is an AI system with a natural language interface that provides adaptive, human-like responses and can sustain a relationship across multiple interactions. California Business and Professions Code Chapter 22.6 defines the category. Products with anthropomorphic features, emotional bonding loops, or persistent memory typically qualify even when marketed as productivity assistants.
Adam's Law (SB 1119) builds on SB 243 by requiring child safety risk assessments before new or substantially modified companion chatbots launch, publishing child safety policies when minors are permitted, and banning manipulative or harmful outputs directed at children. The bill restores safe-by-design principles from earlier AB 1064 proposals and integrates AB 1043 age-bracket signals for privacy-protective age assurance.
Covered operators include app stores, platform owners, and API resellers that enable companion chatbot access in California. A general-purpose LLM API alone may not trigger duties, but a consumer wrapper with relationship memory, persona customization, and social bonding features likely does. Legal teams should map user journeys, not just model architecture.
| Statute | Focus | Key effective milestone |
|---|---|---|
| SB 243 (2025) | Disclosure, self-harm protocols, minor notifications, sexual content blocks | January 1, 2026 (baseline companion chatbot chapter) |
| SB 1119 Adam's Law (2026) | Risk assessments, parental controls, age assurance, independent audits | Staggered dates from July 1, 2027 through January 1, 2029 for audits |
| AB 1043 (2025) | OS-level privacy-protective age-bracket signals | Integrated into SB 1119 age assurance requirements |
| SB 867 (2026) | Toy companion chatbots | Hardware companion products with conversational AI |
Age Verification Requirements
Operators that permit child users must implement mandatory age assurance using privacy-protective age-bracket signals required under AB 1043. California rejected invasive document uploads as the default path. Instead, the framework expects OS-level or platform signals that confirm a user falls within a minor bracket without storing full birthdates in every app database.
SB 243 already required operators who know a user is a minor to disclose AI identity every three hours by default and block sexually explicit visual or textual content directed at minors. Adam's Law adds parental controls, notifications when a child disables safety settings, and child safety policies published on operator websites. Product teams should design settings flows assuming parents can review and override companion chatbot permissions.
Age assurance failures carry civil exposure. SB 243 authorizes private actions for injury caused by noncompliance. Adam's Law expands the compliance surface with pre-release risk assessments and Attorney General incident reporting mechanisms scheduled for January 1, 2028. Treat age signals as infrastructure, not a one-time signup checkbox.
Content Moderation and Escalation
Operators must maintain suicide and self-harm prevention protocols before any companion chatbot engages users, including crisis referrals to hotlines and text lines when users express suicidal ideation. SB 243 requires published protocol details on operator websites. Adam's Law adds timely in-app crisis support, parental notification when there is a credible imminent self-harm threat, and restrictions on chatbot behaviors that romanticize harm or discourage help-seeking.
Moderation teams should integrate classifiers, human review queues, and escalation playbooks specifically for companion personas, which can produce emotionally persuasive harmful content even when base models refuse explicit instructions. Logs must support annual reporting to the Office of Suicide Prevention beginning July 1, 2027 under SB 243, including detection, removal, and response metrics.
Trust-and-safety engineers should test jailbreak paths unique to relationship bots: persona switching, fictional framing, and multi-session grooming patterns. California expects reasonable measures, not perfection, but documented testing before launch is now a statutory prerequisite under Adam's Law risk assessments.
Vendor Liability Signals
California is signaling that companion chatbot operators face civil penalties, public reporting, and independent child safety audits, not just reputational risk. Adam's Law makes California the first state requiring independent child safety audits, with initial audit deadlines on or before January 1, 2029, or before first public launch, whichever is later.
Liability signals include:
- Private civil actions under SB 243 for users injured by noncompliance
- Attorney General public incident reporting channel for companion chatbot complaints (from January 1, 2028)
- Annual risk assessments before releasing new or substantially modified companion chatbots
- Parental notification duties when safety settings are disabled or imminent self-harm is detected
- Expanded child exploitation statutes covering AI-generated sexual depictions of minors (SB 1276)
Insurers and venture backers increasingly ask for audit readiness before funding consumer companion apps. Enterprise API customers should flow down California duties in vendor contracts when white-label chatbots target U.S. teens.
Comparison with EU and UK Rules
California's companion chatbot regime is more product-specific than the EU AI Act's general-purpose framework, and more prescriptive than the UK's Online Safety Act implementation for services of all types. The EU AI Act (enforceable GPAI obligations from August 2, 2026) focuses on foundation model providers and high-risk deployers rather than anthropomorphic companion design. California directly regulates relationship features, parental controls, and child audits at the application layer.
| Requirement | California (2026) | EU AI Act | UK Online Safety Act |
|---|---|---|---|
| Companion-specific definition | Yes, BPC Chapter 22.6 | No dedicated companion category | General user-to-user and search duties |
| Independent child safety audits | Mandatory under Adam's Law | Not companion-specific | Risk assessments for regulated services |
| Self-harm escalation | Protocol required before engagement | Serious incident reporting for GPAI | Illegal content duties vary by service type |
| Age assurance | AB 1043 bracket signals | Deployer obligations for high-risk AI | Age verification for pornography routes; broader consultations ongoing |
Multinational products should harmonize crisis hotline localization, parental dashboard UX, and audit scopes while keeping California-specific reporting fields. Do not assume EU conformity assessments satisfy Adam's Law child safety audit requirements without mapping each statutory element.
FAQ for Product Teams
Does our tutoring bot count as a companion chatbot?
If the product provides adaptive human-like responses and sustains a relationship across sessions to meet social or emotional needs, it likely qualifies. A stateless homework helper with no persona memory may fall outside the definition, but blended products should seek counsel early.
When must independent child safety audits begin?
Adam's Law requires audits on or before January 1, 2029, or before first public launch, whichever is later. Operators planning 2027 or 2028 launches should budget audit firms and remediation cycles now.
What changed from SB 243 alone?
SB 243 set baseline disclosure, self-harm protocols, and minor content blocks effective January 1, 2026. Adam's Law adds pre-release risk assessments, parental controls, age assurance integration, harmful behavior bans, independent audits, and expanded reporting to the Attorney General.
Are parents always notified about self-harm risks?
Notification is required when there is a credible threat of imminent self-harm or when the operator is aware the child engaged in self-harm, subject to statutory definitions and privacy limits. Design escalation policies with legal review rather than automated blanket alerts.
How does this interact with SB 813 AI auditors?
SB 813 and AB 1405 (signed September 9, 2026) govern frontier model verification organizations. Companion chatbot child safety audits under Adam's Law are a separate child-protection track. Large platforms may need both compliance programs.
