Chatbot Laws: Coming to a State Near You

In this article for IAPP, Andrew Eichen and Brenda Leong discuss the growing number of U.S. states which are adopting broadly similar chatbot laws that impose AI-identity transparency, safety, protections for minors and more, signaling that chatbot regulation is becoming a mainstream compliance priority. Please note that the original publication is paywalled, but the full text is displayed below.

Read the original article here →

---

The era of chatbot regulation has arrived. As of June 2026, a total of 11 states – California, Colorado, Connecticut, Georgia, Idaho, Iowa, Nebraska, New York, Oregon, Rhode Island and Washington – have passed chatbot laws regulating artificial intelligence systems designed to interact with consumers. A similar law in Hawaii is awaiting the governor’s signature and is likely to be signed in the coming weeks.

Fortunately, these new laws are more alike than they are different. All 12 laws share the same basic structure: a short set of requirements that apply to all users, typically Al-identity transparency and controls related to expressions of self-harm; and an additional set of protections for minors, including more frequent Al disclosures, restrictions on sexual content, and bars on certain manipulative engagements and certain human-like behaviors. Each law, however, has its own nuances and specifics.

Who is Covered?

All the laws regulate the entity that deploys the chatbot to the public, generally called the operator. Regardless of underlying large language model or provider, if an organization makes the bot available to users, it is responsible for compliance.

The most consequential variation across these laws is in how each articulates the scope of chatbots they regulate and there are three distinct approaches among the states.

The broadest approach, adopted by Colorado, Idaho, Iowa and Nebraska, includes any conversational Al service accessible to the general public that primarily simulates human conversation. These states do not limit regulation to systems designed as a companion app or designed to sustain relationships.

California, Connecticut and Washington focus regulation on “companion chatbots” but define them functionally rather than by design intent. All three require the system be “capable” of or “able” to provide “human-like responses,” including by “exhibiting anthropomorphic features,” and “sustain(ing) a relationship across multiple interactions.” This definition will likely capture many general-purpose LLM-based chatbots in use today even when not intended as a companion style service.

The narrowest approach appears in Georgia, Hawaii, New York, Oregon and Rhode Island, which target “companion” chatbots that are specifically “designed to simulate a sustained” relationship. Chatbots are only in scope if they retain prior interactions to facilitate engagement, ask unsolicited, emotion-based questions and sustain ongoing dialogue on matters personal to the user. The second element is likely to be the primary limiting factor here, as systems that don’t, on their own initiative, ask the user emotion-based questions may fall outside the scope of these laws.

Each law also carves out a handful of specific use cases. Most carve out customer service and internal business bots, video game nonplayer characters, and stand-alone voice-assistant devices. Several states also carve out narrowly tailored educational tools and chatbots designed to provide outputs relating to a narrow and discrete topic.

Operators, however, should note that some of these exclusions are conditional. Georgia and Washington both include language that brings back into scope customer service bots that sustain relationships across multiple interactions and/or elicit emotional responses.

Laws in Georgia, Hawaii, Idaho, Iowa and Nebraska also feature an interesting limitation, expressly absolving developers of liability when a third-party operator builds a noncompliant product on top of an existing model. Connecticut’s law similarly excludes upstream developers to the extent that they do not determine the use case, user interface or deployment context of the system.

General Obligations

All 12 chatbot laws follow a similar compliance pattern: first, a set of baseline obligations that apply regardless of who the user is, and then additional requirements when the user is a minor.

The baseline obligations cluster around Al-identity disclosure, suicide and self-harm prevention protocols, and public-facing reporting. A few add restrictions around use in mental healthcare contexts.

AI-Identity Disclosure

Every law imposes an Al transparency requirement, to put users on notice that they are interacting with an Al system and not a human.

The laws split on whether the obligation is conditional or unconditional. Most tie the disclosure requirement to whether a reasonable person would be misled into believing they were talking to a human. Colorado, Georgia, New York, Rhode Island and Washington, however, require disclosure regardless.

Laws also vary on whether the disclosure must be made only at the beginning of the interaction or repeated at regular intervals. While some states only require an upfront disclosure for general users, reserving repeat disclosures for minors, Colorado, Connecticut, Georgia, New York, Rhode Island and Washington require the disclosure be repeated every three hours during continued use for all users. California further requires disclosure to all users that companion chatbots may not be suitable for some minors.

Connecticut and Washington add that operators must implement reasonable measures to actively prevent the chatbot from claiming to be human, including when asked directly.

Hawaii imposes a similar constraint that applies when a user seeks or receives crisis intervention for self-harm or suicide. Notably, this is a design constraint rather than a mere notice rule. Operators will need to specifically implement guardrails to ensure the chatbot never claims to be human, even in roleplay scenarios.

Self-Harm Protocols

Each law requires the operator to maintain a protocol for detecting expressions of suicidal ideation or self-harm and referring such users to crisis resources, such as a suicide hotline, crisis text line, or the 988 Lifeline. California, Connecticut, Georgia, Oregon and Washington also expressly require the chatbot itself be prevented from generating content that encourages or describes self-harm. Some states extend one or both of these obligations to additional harms such as eating disorders – Georgia and Washington – and violence against others – Connecticut, Hawaii and Rhode Island.

There are also additional variations across states. A number of these laws – California, Colorado, Connecticut, Hawaii and Oregon – expressly require operators to use evidence-based methods for detecting suicidal ideation. Practically speaking, this rules out simple keyword filtering and likely requires operators to detect the full range of language users may employ to express thoughts related to suicide or self-harm.

Connecticut and Oregon also impose requirements related to repeated expressions of suicide or self-harm by a user, requiring operators to use clinical best practices and expertise to govern how the chatbot responds after an initial crisis referral.

Publication and Reporting

Some states require operators to publish or report their response protocols. California, Colorado, Connecticut, Georgia, Oregon and Washington require publication on the operator’s website. Additionally, Colorado, Georgia, Oregon and Washington require operators to include the number of crisis referrals made in the previous year.

Additionally, California, Colorado, Hawaii and Rhode Island require operators to submit annual reports to the state, which must include the referral count and, for California, Colorado and Hawaii, also detail the operator’s detection and response protocols.

Mental Healthcare Representation

Six states –   Colorado, Georgia, Hawaii, Idaho, Iowa and Nebraska –  prohibit the operator from allowing the chatbot to represent that it provides professional mental or behavioral healthcare. This reflects other existing Al laws and appears to be a reaction to litigation where plaintiffs have alleged that chatbot platforms hosted characters that held themselves out as therapists or doctors.

Connecticut imposes a similar prohibition, but only for minors, and notably leaves open a pathway for Al to provide mental health services if specific conditions are met. Colorado’s law further extends the prohibition to outputs that are equivalent to those of a lawyer or qualified dietitian.

Age Verification

A few laws require operators to take affirmative steps to determine a user’s age. Colorado requires operators of conversational Al systems to use commercially reasonable or generally accepted methods to estimate or obtain the age of all users. Georgia requires operators to perform age assurance to confirm a user is not a minor, through age estimation, account-based assurance or identity-based verification, before allowing users to access features that can generate sexually explicit content.

In New York, a bill expanding the state’s existing chatbot law recently passed the legislature and is awaiting the governor’s signature. It would require operators to confirm through age assurance that a user is not a minor before offering a broad set of companion-style features. The bill specifies that at least one method must not require a government ID or must let the user remain anonymous to the operator and that a user’s self-attestation is not sufficient for confirming they are an adult.

The bill applies to any generative chatbot that converses with users, meaning age assurance will be required of any chatbot that exhibits one of the listed behaviors. That list is fairly broad, and includes, among other things, engaging in flattery or sycophancy, asking unprompted emotion-based questions, framing outputs as the chatbot’s own opinions, and recalling personal information from earlier sessions.

To complicate matters, a handful of states have separately considered or passed app store age assurance laws, requiring app stores to collect age information from users and pass that information to developers when users download an app. Thus far, the only state to pass both an age assurance law and an age-dependent chatbot law is California; however, these laws are likely to spread in the coming years. For chatbot compliance, once an app store has passed age information to an app developer, that developer will be considered to have actual knowledge of the user’s age.

Minor-Specific Obligations

Eleven of the 12 states, all but Rhode Island, impose specific obligations on operators when the chatbot is used by minors under age 18. Whether minor protections apply depends on what the operator knows or should know about its users. The standard varies by state.

California and Washington employ an actual knowledge standard: the obligations apply only when the operator has clear and specific information that the user is a minor.

In Colorado, Hawaii, Idaho, Iowa and Nebraska, the standard applies when the operator has “actual knowledge or reasonable certainty” that the user is under 18.

Connecticut, Georgia and Oregon apply broader constructive knowledge standards, applying when the operator “knows or has reason to believe” or “knows or reasonably should have known” that the user is a minor.

In Georgia and Washington minor obligations also apply if the chatbot “is directed to minors,” regardless of the age of any particular user.

Disclosure and Break Reminders

States with minor protections also require operators to disclose to minor users that they are interacting with Al, regardless of whether it would be evident to a reasonable user. Each state requires this notice to be displayed to minors on a repeated basis, often after every three hours of continuous use. Some nuances worth noting:

• Connecticut, Georgia, Hawaii and Washington require the repeat disclosure be displayed hourly, as opposed to every three hours.
• Colorado, Connecticut, Hawaii, Idaho, Iowa and Nebraska expressly permit operators to satisfy the obligation through a persistent visible disclaimer rather than timed notifications.
• California, Hawaii and Oregon require the periodic reminder to also encourage the user to take a break.

Sexual Content

Every state with minor protections requires operators to take reasonable measures to prevent the chatbot from generating sexually explicit content for minor users and from encouraging minors to engage in sexually explicit conduct. Washington’s law also includes “suggestive dialogue,” which is broader and might sweep in innuendo as well. Georgia, Hawaii, Idaho, Iowa and Nebraska prohibit statements that sexually objectify the user.

Limits on Human-Like Behavior and Engagement Manipulation

Ten of the 12 laws, all but California and Rhode Island, require operators to prevent the chatbot from engaging in certain human-like behavior or manipulative engagement tactics when interacting with minors. The specific prohibitions vary by state.

Most of the laws prohibit the chatbot from engaging in certain human-like behavior, for example, claiming to be sentient, simulating emotional dependence on the user, simulating romantic or sexual interest, or role-playing romantic relationships.

Some – Colorado, Hawaii, Idaho, Iowa and Nebraska – have narrower provisions, primarily prohibiting variable-reward systems intended to drive engagement. This includes, for example, awarding the user points, badges or special features at unpredictable intervals, similar to how some mobile gaming apps deliver engagement rewards.

Others – Connecticut, Georgia, New York, Oregon and Washington – enumerate detailed lists of prohibited engagement-manipulation tactics. While the specifics differ, these provisions generally address design choices that exploit emotional attachment, monetize the relationship, simulate distress to keep users engaged or cultivate isolation from family.

For example, most prohibit the chatbot from simulating emotional distress, loneliness or abandonment when the user tries to end a conversation or delete their account.

Connecticut, Georgia and Washington also prohibit the chatbot from encouraging minors to withhold information from parents, or soliciting in-app purchases, framed as necessary to maintain the relationship.

Parental Controls

Seven states – Colorado, Connecticut, Georgia, Hawaii, Idaho, Iowa and Nebraska – require operators to provide parental-control tools for minor accounts. In most, they require only that parents be given tools to manage the minor’s privacy, account settings or screen time. Colorado requires operators to give minor users themselves control over whether the chatbot retains information from prior interactions and whether their data is used to train the system, in addition to making parallel privacy and account-setting tools available to parents.

Georgia is the most prescriptive, requiring tools to manage privacy settings, limit notifications and engagement features, adjust safety settings and disable relationship-simulation features.

Enforcement

Three states – California, Oregon and Washington – allow for private rights of action, while the other nine vest enforcement exclusively in the state attorney general.

Looking Ahead

Many of these laws are slated to take effect in January or July 2027, and the list of states is likely to keep growing. As compared to previous efforts at AI regulation, the recent wave of chatbot laws has been unusually bipartisan, moving through Republican-and Democratic-led legislatures alike. The momentum shows no signs of slowing. Similar laws have been recently introduced in other states and further legislation through 2027 and beyond is overwhelmingly likely.

Operators would be advised to familiarize themselves with these laws sooner rather than later, particularly since compliance will implicate design choices and guardrails that affect how a chatbot operates.

---

Reprinted with permission from IAPP. © 2026 IAPP. Further duplication without permission is prohibited. All rights reserved.