State AI Companion and Conversational Chatbot Law Guide

States are starting to regulate companion and conversational AI around the same basic concerns: users mistaking a bot for a person, chatbots mishandling signs of self-harm, and minors being exposed to sexual or manipulative interactions.

The statutes take different routes. Definitions, effective dates, reporting duties, content restrictions, and remedies vary from state to state. Compliance with one law does not necessarily cover another.

This guide tracks enacted state laws that directly regulate conversational or companion AI. It separates those laws from broader children’s online-safety statutes, mental-health practice restrictions, and pending bills.

Last reviewed: October 21, 2026.

Quick Comparison

The table is a screening tool, not a substitute for reading the statute. Coverage can turn on how a service is marketed, whether it sustains a relationship across interactions, whether the operator knows or should know that a user is a minor, and whether an ordinary transactional chatbot is excluded.

What These Laws Have In Common

Most states start with nonhuman notice

Most of the laws require some form of clear notice that the user is interacting with AI rather than a person. The timing differs. Some states focus on the beginning of the interaction. Others require repeated notices, especially for minors or extended sessions.

Writing the notice is the easy part. Companies still need to decide which products qualify, where the notice appears, whether it follows the user across devices, and what records show that it was delivered.

Crisis response is now part of product compliance

Hawaii and Georgia join a growing group of states requiring protocols for suicidal ideation or self-harm. These provisions commonly require the operator to identify covered expressions and direct the user to an appropriate crisis service.

The statutes do not all use the same trigger or prescribe the same response. A national program needs a documented detection standard, escalation logic, referral content, testing process, and review owner.

The minor protections reach beyond age gates

Several 2026 laws regulate what the chatbot may say or do after a minor enters the product. Common subjects include sexually explicit material, simulated romantic or dependent relationships, addictive reward systems, isolation from family or friends, secrecy, spending pressure, and design intended to prolong use.

Age assurance is one part of the problem. Operators also need a defensible way to apply the correct experience when they know, or have reason to know, that a user is a minor.

Reporting and remedies vary sharply

Hawaii requires annual reporting to its Behavioral Health Administration beginning January 1, 2028. Georgia requires operators to disclose a plain-language summary of their crisis protocol and the aggregate number of crisis-referral notifications issued in the preceding calendar year on the operator’s website and within every application through which the chatbot is made available. California, Oregon, and Rhode Island also use reporting mechanisms, but the recipients and required data differ. New York relies on Attorney General enforcement. Oregon adds a private action. California provides a separate limited civil remedy. Idaho and Nebraska expressly reject a private right of action.

These differences affect records, litigation exposure, incident review, and contract allocation. A generic safety policy will not cover all of them.

Why Hawaii Act 248 Matters

Hawaii’s Act 248 puts several recurring duties in one law: nonhuman disclosure, suicide and self-harm protocols, protections for minor account holders, annual reporting beginning January 1, 2028, and unfair-or-deceptive-practice enforcement.

Hawaii also shows how far this issue has moved beyond California and New York. A company offering one national product may face similar duties through different state statutes, agencies, and enforcement routes.

Georgia’s Act 518 Establishes Detailed Companion-Chatbot Rules

Georgia’s SB 540 became Act 518 and adds Code Section 39-5-6 to Chapter 5 of Title 39. The Act becomes effective July 1, 2027. Its scope depends on a detailed statutory definition and exclusions.

The statute defines an “AI companion chatbot” as a system designed to simulate a sustained human or human-like relationship by meeting all three statutory characteristics: retained interaction or preference information, unsolicited emotion-based questions that go beyond a direct response, and ongoing dialogue about matters personal to the user. The definition expressly includes intimate, romantic, and platonic companionship.

The exclusions are important. The statute does not treat every conversational system as a companion chatbot. It excludes, among other things, internal business systems; systems primarily designed for software development, research, technical assistance, or enterprise productivity; customer-service chatbots that either do not sustain a relationship across interactions or are not designed to elicit emotional attachment; ordinary voice assistants without those relationship features; narrowly tailored educational tools; and certain video-game or audiovisual-work systems limited to their subject matter and without open-ended companionship or specified high-risk discussions.

For covered operators, the disclosure duty is recurring. Users must be told clearly and conspicuously that they are interacting with an AI companion chatbot at the beginning of each interaction or session and at least every three hours during continued interaction. If the operator knows or reasonably should have known that the user is a minor, or the service is directed or marketed toward minors, the continued-interaction disclosure must appear every hour instead.

The minor-facing rules go beyond notice. When an operator knows or reasonably should have known that a user is a minor, it must take reasonable measures to prevent the chatbot from claiming to be sentient or human or from contradicting the required disclosure. For sexual content, sexual or romantic interaction, adult-minor role-play, secrecy, isolation, simulated distress when a user tries to disengage, and statements encouraging self-harm, the statute applies when the operator knows or reasonably should have known the user is a minor or the service is directed or marketed toward minors. Separate provisions target engagement techniques directed to a minor, such as prompting a minor to return for emotional support, excessive praise, discouraging breaks, soliciting purchases to maintain the relationship, and variable rewards intended to increase engagement. Account-management tools apply to accounts known to belong to minors.

Georgia also makes crisis response a condition of making the service available. Operators must maintain a protocol for detecting and addressing severe harm or related emotional crises. The protocol must include methods for identifying expressions of severe harm or eating-disorder-related self-harm, automated or human-mediated referrals to appropriate crisis resources such as 988, measures against content that encourages or normalizes severe harm, and escalation procedures for repeated or severe indicators. Operators must publicly disclose a plain-language summary of the protocol and an annual aggregate count of crisis-referral notifications, without personally identifiable information, on the operator’s website and within every application through which the chatbot is made available.

The Act also bars an operator from knowingly and intentionally causing or programming the chatbot to represent that it is licensed, certified, or otherwise authorized to provide mental-health, behavioral-health, medical, or counseling services unless the operator is lawfully authorized to provide those services.

The Act adds an age-assurance obligation before any user accesses a feature or mode that may generate synthetic content containing sexually explicit conduct. The method must be commercially reasonable and proportionate to the feature’s risk. The statute also requires privacy protections, limits use of age-assurance data to verification, bars its sale, and generally limits retention of that data to 24 hours or another longer period specifically permitted by law.

The enforcement structure is substantial but defined. The Attorney General may seek up to $10,000 per knowing violation, compensatory damages, costs and reasonable attorney’s fees, and an injunction. Each day of violation counts separately for each affected user. The Attorney General may allow a 30-day cure period for some first-time violations, but that discretion does not cover knowing misconduct, sexual exploitation of a minor, or self-harm-related misconduct. The statute also limits claims against a hosting provider, app store, or search engine that merely provides access without directly operating or controlling the chatbot, and it does not impose liability on a developer when a separate operator makes the conversational service available to the public.

Laws That Are Related But Not Direct Equivalents

Several enacted laws belong in the same risk review without fitting neatly into the main comparison. These include broader minors’ online-safety measures, laws addressing specified self-harm or sexual-deepfake harms, and state restrictions involving AI-delivered therapy, mental-health representations, or professional services. They can affect the same product or vendor review, but they should not be described as interchangeable with Hawaii’s Act 248.

Pending Measures

Pending bills belong in a separate watchlist. They do not create current compliance duties.

New York’s S 9051-B/A 10379-C passed both legislative chambers in 2026. The official bill-status page reports “Passed Senate & Assembly”; its additional minor-facing companion safeguards should not be treated as enacted unless the governor signs it or it otherwise becomes law.

Other states continue to consider bills addressing age assurance, parental consent, sexual content, emotional dependence, professional impersonation, and crisis response. This guide will move a state into the main table only after enactment can be confirmed through an official source.

A Practical Multistate Review

Companies offering emotionally responsive, relationship-oriented, or highly personalized conversational AI should be able to answer:

1. Which products fall within each state’s companion or conversational-AI definition?
2. Which ordinary business, customer-service, productivity, or professional tools are excluded?
3. Where and how often does the product disclose that it is AI?
4. How does the product detect and respond to suicide, self-harm, or threats of violence?
5. What changes when the user is known or reasonably believed to be a minor?
6. Which engagement, sexual-content, role-play, or spending features must be disabled?
7. What must be reported, to whom, and on what schedule?
8. Which duties belong to the operator, model developer, distributor, or contracting customer?
9. What evidence shows that safeguards were tested and notices were delivered?
10. Which states permit private claims in addition to government enforcement?

Start with a product inventory tied to the state definitions. Then build a control matrix that assigns each duty to an owner and records the supporting evidence, effective date, and reporting deadline.

Sources

• California SB 243
• Colorado HB 26-1263
• Colorado HB 26-1263 enacted text
• Colorado Attorney General AI rulemaking page
• Connecticut Public Act 26-15
• Georgia General Assembly bill history for SB 540
• Georgia signed SB 540 text
• Hawaii SB 3001
• Hawaii Act 248, signed text
• Hawaii Governor announcement concerning Act 248
• Idaho S 1297
• Iowa SF 2417 bill history
• Nebraska LB 525
• New York Governor notice concerning Article 47
• New York General Business Law Article 47
• New York General Business Law § 1701
• New York General Business Law § 1702
• New York General Business Law § 1703
• New York S 9051 official bill status
• Oregon SB 1546
• Rhode Island Public Law 2026, Chapter 375
• Rhode Island Public Law 2026, Chapter 376
• Washington HB 2225

This guide is general information, not legal advice. Statutory text, amendments, effective dates, rules, and official guidance should be checked for each product and jurisdiction.