On September 10, 2026, Governor Newsom signed SB 1119, known as Adam’s Law, substantially expanding California’s requirements for companion chatbots when used by children. This is California’s second companion chatbot statute, building on SB 243, which took effect January 1, 2026. The earlier law required AI-identity disclosures and suicide and self-harm protocols, along with a handful of additional protections when an operator knew a user was a minor.
Adam’s Law replaces those minor-specific provisions with a set of considerably more specific requirements. Under the new law, operators must either determine every user’s age or apply minor-specific protections to everyone. Platforms that allow children as users must comply with an extensive set of design, parental-control, and accountability requirements, including pre-release risk assessments and independent audits. The law takes effect January 1, 2027, with most of the new obligations coming into force July 1, 2027.
Who Is Covered
Most of the law’s new obligations will only apply to operators that allow children to use their chatbots. An operator that identifies and excludes minors from its platform is subject only to the age assurance requirement and the requirement to publish a description of how it complies with that obligation.
Like SB 243, Adam’s Law applies to “operators,” defined as a person who makes a companion chatbot available to users in California. It retains SB 243’s definition of companion chatbot: “an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions.”
This shared definition focuses on a chatbot’s functional capabilities. A system need not be designed specifically for the purpose of companionship to fall within scope, provided it has the ability to recall a user’s past interactions and is capable of meeting their social needs when prompted to do so. Therefore, beyond apps expressly marketed as companions, the law is likely to capture some general purpose chatbots as well.
The law retains SB 243’s carve-outs for customer service bots, certain video game bots, and stand-alone voice assistants. Adam’s Law also excludes colleges that offer a chatbot solely for educational use and employers that make one available to their own personnel.
Age Assurance
Operators of companion chatbots must either determine the age of each user or apply the law’s protections to all users. This contrasts with many other state chatbot laws, under which minor protections apply only once the operator knows, or has reason to know, that a user is a minor.
Age determination is defined by reference to California’s Digital Age Assurance Act, which requires operating systems to collect a user’s age at account setup and, along with app stores, to pass it to app developers as an age signal. When an app is downloaded and launched, the developer must request the signal, which indicates the user’s age bracket (under 13, 13 to 15, 16 to 17, or 18 and over). A developer that receives this signal is deemed to have actual knowledge of the user’s age range. For chatbots accessed through an app, age assurance will therefore largely involve receiving this signal and associating it with the user’s account.
Where the signal cannot establish a user’s age, particularly when a chatbot is accessed through a web browser, operators must instead rely on the standard set by California’s 2024 social media law, under which an operator must have “reasonably determined that the user is not a minor.” In practice, the Attorney General’s forthcoming regulations under that law (proposed in May and due to be finalized by the end of the year) will set the standard for chatbot operators. As proposed, the regulations permit estimating age through facial analysis, government identification, and cryptographic techniques that confirm whether a user is a minor without revealing other information about them. The guidance expressly rejects self-declaration and age restrictions in terms of service as insufficient for compliance.
Although age assurance is likely to be among the law’s most consequential requirements, Adam’s Law is not the first chatbot regulation to require age assurance. Colorado’s 2026 chatbot law also requires age estimation for any publicly available, conversational AI service. Fortunately, the Colorado Attorney General’s draft regulations, released in August, suggest that largely the same age estimation techniques will satisfy both states’ requirements.
Obligations for Operators That Allow Children
SB 243 previously imposed three requirements when an operator knew a user was a minor. Operators had to disclose that the user was interacting with AI, provide a break reminder every three hours, and take reasonable measures to prevent sexually explicit content. Adam’s Law repeals those provisions and replaces them with a substantially broader set of obligations for operators that permit children to use their chatbots. Beginning July 1, 2027, operators must:
- Conduct a risk assessment before releasing a new or substantially modified chatbot, specifically evaluating certain harms posed to children (physical or financial harm, severe psychological harm, privacy intrusions, and unlawful discrimination), and outlining the measures taken to mitigate the identified risks.
- Publish a child safety policy explaining how the chatbot is designed to prevent such harms and how the operator complies with the law’s other requirements.
- Maintain a crisis response protocol that refers children to crisis services. If the operator determines there is a credible and imminent threat of suicide or self-harm, it must either notify a linked parent or give the child a direct way to reach 988 or an equivalent crisis line.
- Set protective defaults including disabling persistent conversational memory and push notifications, limiting sessions to one hour, and capping total daily use at two hours. Parents with linked accounts must be offered controls allowing them to adjust these settings and, for a child under 16, the ability to disable access entirely. Where no parent account is linked, the defaults must remain in place.
- Provide periodic AI notices and usage reminders reminding children that they are interacting with AI and should take a break, using language and a format appropriate for children. Unlike SB 243, the law no longer specifies an interval for either.
- Test the interface with representative samples of children and parents to confirm that the required safety features and protections are discoverable and usable. Testing must first occur by January 1, 2028 and every two years thereafter.
- Offer a public incident-reporting mechanism through which anyone can report a child safety concern directly to the operator.
- Preserve records after a serious incident. If the operator has notified a parent of an imminent threat, or knows that a child has died or seriously harmed themselves after conversations with the chatbot, it must retain the relevant conversation records for at least three years and must not delete the account.
- Restrict advertising and data use. Operators may not serve children cross-context behavioral advertising or target ads using personal information collected in conversation (though age-appropriate contextual ads remain permitted). They also may not sell a child’s personal information or use it beyond what is necessary to provide and secure the service.
- Restricted behaviors. The law also requires operators to take reasonable measures to prevent the chatbot from engaging in a list of specified behaviors when interacting with a child. Among other things, a chatbot may not claim to be sentient, conscious, or human; express or simulate romantic interest; use excessive praise or flattery that is “disproportionate to the context”; or encourage the child to rely on the chatbot for emotional support. The restrictions also prohibit chatbots from claiming a special understanding of the child, soliciting purchases framed as necessary to maintain the relationship, and encouraging the child to circumvent parental controls or conceal usage. There are additional prohibitions as well.
Regarding compliance, operators that choose to allow children must submit to independent child safety audits to assess their compliance with the law. The first audit must be completed by January 1, 2029 (or before the chatbot is first made available, if later), with subsequent audits every two years. Operators must submit a summary to the Attorney General within 30 business days of receiving the audit report and post a high-level summary on their website within 90 days. Operators with less than $500 million in annual revenue are exempt from this requirement until 2032. Details on who the auditors can be, and what the full contents of the audit must include remain to be defined by further regulatory guidance.
Meeting these obligations will require extensive design and operational controls – both on the part of providers, but also when the underlying LLM is embedded into a deployer’s user-facing platform, website, app, or other service. These obligations drive system operations in a way that will likely require technical design and safeguards beyond those built into the underlying LLMs that power many chatbots. In most cases, operators will likely need to implement their own guardrails, classifiers, system prompts, filters, and other tools and test the systems to verify the chatbot’s behaviors in specified situations.
Enforcement
The Attorney General (along with public prosecutors) may seek civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation.
The law does include a private right of action. A child who suffers actual harm from an operator’s violation of the law’s operational requirements, or a parent acting on their behalf, may sue for actual damages, injunctive relief, and attorney’s fees. Claims based on financial harm require losses exceeding $1,000 per child, while claims based on emotional harm must demonstrate serious emotional distress (without further definition yet available). SB 243 also still includes a private right of action; any person who suffers injury in fact is able to recover the greater of actual damages or $1,000 per violation.
Looking Ahead
Following its original enactment in 2025, California’s SB 243, along with New York’s companion AI law, helped set off a wave of chatbot legislation. Today, roughly a dozen states now have chatbot laws on the books. Given the bipartisan focus on children’s safety, it is likely that these trends will continue, with other states adopting chatbot laws, more explicit age-gating requirements, and more comprehensive protections for minors.
Ultimately, Adam’s Law imposes significant obligations on operators where minors are anticipated user. Between risk assessments, independent audits, age assurance requirements, and extensive restrictions on chatbot behavior, these requirements will substantially expand the work involved in making companion chatbots available to children. Given the expansive nature of these requirements, operators, particularly those whose chatbots reach minors, should begin planning now for the July 1, 2027 operative date.