I started looking more closely at Hawaii’s new conversational-AI law because it seemed familiar.
Act 248 requires AI disclosures, suicide and self-harm protocols, protections for minor account holders, and annual reports to the state Behavioral Health Administration. Violations can be treated as unfair or deceptive practices.
California, New York, Oregon, Washington, Connecticut, Colorado, Idaho, Iowa, Nebraska, Georgia, and Rhode Island have enacted laws that reach parts of the same product category. Once those statutes are placed next to one another, the overlap is obvious. So are the differences.
I could not find a useful way to explain that in a short state update. So I built a State AI Companion and Conversational Chatbot Law Guide for Clearon.
A State Count Does Not Tell You What To Build
“Similar laws” is a fair description. Product and legal teams still need the differences before they can decide what to build.
One state may require recurring disclosures. Another may focus on the start of the interaction. Some regulate crisis referrals for every user. Others add detailed restrictions for minors involving sexual content, emotional dependence, reward systems, secrecy, isolation, or spending pressure.
The reports go to different places. Hawaii uses its Behavioral Health Administration. California uses its Office of Suicide Prevention. Rhode Island requires reports to the Attorney General. Oregon has a separate reporting structure.
The remedies differ too. Some statutes rely on state consumer-protection enforcement. Oregon provides a private action for ascertainable harm. California includes a separate limited civil remedy. Idaho and Nebraska say their laws do not create a private right of action.
Those choices affect product design, recordkeeping, contracts, and litigation risk.
What The Guide Covers
The guide compares enacted laws in twelve jurisdictions that directly regulate companion or conversational AI:
- California
- Colorado
- Connecticut
- Georgia
- Hawaii
- Idaho
- Iowa
- Nebraska
- New York
- Oregon
- Rhode Island
- Washington
For each jurisdiction, the guide identifies the law and operative date, then compares disclosure, crisis response, protections for minors, reporting, and enforcement.
The guide keeps related laws in a separate section. Broader children’s online-safety statutes, therapy-bot restrictions, and narrowly targeted criminal provisions may belong in the same risk review, but they do not regulate the same products in the same way.
Pending bills stay in a separate section. Legislative passage is not enactment, and a proposal does not create a current compliance duty.
The Repeated Requirements
The statutes keep returning to four practical questions.
Does the user know this is AI? A notice may be required at the start of an interaction, during a long session, or more often when a minor is involved.
What happens when a user expresses suicidal thoughts or an intent to self-harm? The answer has to work inside the product. It also has to be tested and documented.
What changes for minors? The newer laws reach the conversation and the engagement design. They address sexual content, simulated dependence, isolation from trusted adults, rewards, and emotional pressure to keep using the product.
Can the company prove what happened? Annual reports, Attorney General inquiries, and private claims all depend on records. A company may need to show which notice appeared, how the system handled a crisis signal, and which safeguards were active for a minor account.
Hawaii Shows Why A Multistate Map Is Necessary
Act 248 sits near the center of this group. It combines disclosure, crisis protocols, minor protections, reporting, and consumer-protection enforcement. It still falls short as a national template.
A company could satisfy Hawaii’s reporting route and miss California’s reporting details. It could comply with one state’s disclosure language and miss another state’s frequency requirement. It could maintain a general minor-safety policy without addressing Washington’s or Idaho’s more specific engagement restrictions.
I think a control matrix is more useful than twelve isolated memos. Each duty can be assigned to a product owner and matched with an effective date, a technical or operational control, and evidence that the control works.
This Will Need Maintenance
The guide is dated and was last reviewed July 29, 2026.
Several laws have 2027 operative dates. Colorado rulemaking is still developing. New York has a separate minor-safety bill that passed both chambers but had not been confirmed as enacted when the guide was prepared. Other states are considering their own measures.
I drew a firm line between enacted duties and pending proposals. A state will move into the main table only after enactment can be confirmed through an official source.
Blending bills, signed laws, effective requirements, investigations, and enforcement findings produces a misleading picture of what companies must do now.
Companion chatbot regulation has become a multistate compliance issue.
The statutes share a basic structure: nonhuman notice, crisis response, protections for minors, reporting, and enforcement. The legal work is in the differences.
Read the new State AI Companion and Conversational Chatbot Law Guide for the comparison table, source links, and practical review questions.