The Chatbot Compliance Wave: California’s New Law Is Not the Only One to Watch

Current as of October 7, 2026 | This alert addresses fast-moving state legislation; some provisions summarized below are subject to further rulemaking or amendment.

Background on Companion Chatbot Law

The companion chatbot law, authored by Sen. Steve Padilla, was the first state law to pair AI chatbot safety and disclosure requirements with a private right of action and youth-specific protections. It took effect January 1, 2026, and requires covered operators to (1) clearly disclose that a user is talking to AI, not a human, whenever a reasonable person could otherwise be misled, particularly for “companion” chatbots designed to sustain ongoing, human-like relationships; (2) implement protocols to detect and respond to signs of self-harm or suicidal ideation, including referral to crisis resources; (3) apply additional safeguards for minors, including break reminders and restrictions on sexualized content; and (4) file annual reports to the Office of Suicide Prevention. Critically, the companion chatbot law created a private right of action, which has been the single biggest driver of exposure under the statute.

What Changed on September 10

On September 10, 2026, Newsom signed a follow-on package of child safety laws, including SB 1119 (aka Adam’s Law), that goes further than the companion chatbot law’s baseline disclosure-and-safeguards model. Covered operators must now conduct a risk assessment before rolling out any new chatbot feature aimed at, or reasonably likely to reach, minors, rather than addressing risk after a feature ships. Companies that violate Adam’s Law face penalties of up to $5,000 per affected child for each negligent violation, and up to $15,000 per affected child for each intentional violation. In addition, Adam’s Law creates a private right of action under which a prevailing plaintiff may recover actual damages, reasonable attorney’s fees and costs, injunctive or declaratory relief, and any other relief the court deems proper. Nine months after the companion chatbot law took effect, the trend line in Sacramento is toward more obligations, not fewer, and the state’s newest law shifts the compliance burden earlier in the product lifecycle, from disclosure at launch to risk assessment before launch.

SB 1119 does not change the definition of a companion chatbot. So, operators who previously determined that California’s companion chatbot law did not apply to them likely do not need to conduct the risk assessment. However, because the prior law includes many ambiguities about what is covered as a companion chatbot, any operator who previously determined it was not clear whether the law applied to them should consider revisiting that analysis in light of this development and heightened risk.

The State-by-State Ripple Effect

California is not alone. The following states have also enacted chatbot-specific laws, the majority of which will take effect after January 1, 2027, quickly fragmenting the compliance landscape and adding complexity for companies operating across states.

Source: Future of Privacy Forum 2026 Chatbot Legislation Tracker

The Parallel Track: Wiretapping Theories

Separately from the disclosure obligations under these chatbot laws, plaintiffs’ firms are using decades-old wiretapping and eavesdropping laws to challenge chatbots that record conversations or route them to third-party AI vendors without consent. This theory has grown from roughly two federal cases in 2021 to more than 58 active matters in early 2026, including recent suits alleging that “incognito” chat modes did not actually stop data from reaching third-party partners. This risk exists independent of the companion chatbot law or any state-specific chatbot law, and it is not resolved by compliance with any of the laws summarized above.

Why It Matters

• Laws’ scope may be broader than expected. Companies with a chat, support, or companion interface reachable by a resident of the above listed states are likely already in scope of at least one enacted law.
• Disclosure alone may not be enough. Several of the newest laws call for repeated or context-specific disclosure, rather than a one-time banner at sign-up, requiring product and engineering changes.
• Vendor and backend conduct is an independent risk not covered by compliance with chatbot laws. Plaintiffs’ firms are separately pursuing wiretapping and eavesdropping claims against any chatbot operators whose conversations are recorded or routed to third-party AI vendors without adequate consent, including claims that “private” or “incognito” modes did not match backend behavior.
• The compliance timeline has moved earlier. California’s newest law requires a pre-launch risk assessment for features reaching minors. Companies built around a launch-then-fix compliance model may need to move that review earlier in the product cycle.

Next Steps

Companies with a chat, support, or companion product may want to consider the following:

• Exposure and scope mapping. Identify every AI chat, support, or companion feature that could reach a resident (including a minor) of a state with an enacted chatbot law. Because several states’ definitions turn on specific design features (memory/personalization, unprompted emotional questions, sustained relationship-building) rather than the word “chatbot” itself, a feature-by-feature review may be necessary to determine what is in scope.
• Disclosure design, not just disclosure language. A one-time banner will not satisfy most of the newer laws. Disclosure cadence varies by state and by user age, commonly a persistent visible disclaimer or a disclosure at the start of each session plus a recurring reminder every one to three hours, with several states requiring the shorter (hourly) interval specifically for minors. Companies operating across multiple states may want a single disclosure design built to the strictest applicable cadence, rather than maintaining state-specific logic.
• Crisis and self-harm response protocols. Nearly every law enacted requires a documented protocol for detecting expressions of suicidal ideation or self-harm and referring the user to crisis resources (the 988 lifeline is the common reference point). Several states also require that protocol to be published publicly and, in some cases, that referral counts be reported annually. Companies may want to confirm they have (a) an actual detection mechanism, not just a static disclaimer, (b) a real crisis-service referral flow, and (c) a retained, auditable record of when the protocol triggered, since several statutes require reporting aggregate activation counts and a defensible record is the only way to produce that data credibly if challenged.
• Litigation exposure triage. As described in the table above, exposure differs meaningfully by state. Some laws (California, Oregon) allow individuals to sue directly for statutory or actual damages, while others (New York, Colorado, Nebraska, Idaho, Hawaii, and Iowa) expressly limit enforcement to the state’s attorney general. Companies may want to treat these two categories differently in their risk assessment, prioritizing remediation in private-right-of-action states where a single user complaint may become a claim without regulator involvement.
• Reporting and recordkeeping calendar. Several states (California, Colorado, Georgia, Hawaii, Oregon, Rhode Island, and Washington) impose annual public reporting obligations with staggered effective dates (some beginning July 2027, others January 2028). Companies may want to build a reporting calendar now, since the underlying data (crisis referral counts, protocol details) needs to be captured prospectively; it generally cannot be reconstructed retroactively if the operator did not log it at the time.
• Vendor and data-flow diligence. Beyond the chatbot-specific laws, plaintiffs’ firms are separately pursuing wiretapping and eavesdropping theories against operators whose chat data is recorded or routed to third-party AI vendors without adequate consent, including claims specifically targeting “private” or “incognito” modes that don’t match their backend behavior. This exposure is independent of compliance with any state’s chatbot laws, so vendor contracts and data-flow diagrams should be reviewed for any feature marketed as private or incognito.
• Launch process timing. Adam’s Law requires a risk assessment before any new or updated chatbot feature reaches minors, shifting compliance review from a launch-day checklist item to a design-and-spec-stage gate. Companies may want to build this assessment into their existing product review process now, rather than relying on launch-readiness or legal sign-off to catch it after the feature is built. Retrofitting compliance post-launch may be harder and, under Adam’s Law’s framing, potentially noncompliant on its own terms.
• Ongoing monitoring. With additional bills pending and several enacted laws still subject to attorney general rulemaking (e.g., Colorado) a one-time compliance review unlikely suffices. Companies may want to establish a recurring (e.g., quarterly) legislative and rulemaking review rather than treating this as a one-time project.