State AI Companion and Conversational Chatbot Law Guide

States are starting to regulate companion and conversational AI around the same basic concerns: users mistaking a bot for a person, chatbots mishandling signs of self-harm, and minors being exposed to sexual or manipulative interactions.

The statutes take different routes. Definitions, effective dates, reporting duties, content restrictions, and remedies vary from state to state. Compliance with one law does not necessarily cover another.

This guide tracks enacted state laws that directly regulate conversational or companion AI. It separates those laws from broader children’s online-safety statutes, mental-health practice restrictions, and pending bills.

Last reviewed: July 29, 2026.

Quick Comparison

State	Law	Status or operative date	AI disclosure	Suicide or self-harm protocol	Minor-specific protections	Reporting	Enforcement
California	SB 243, Chapter 677 (2025)	Effective January 1, 2026; annual reports begin July 1, 2027	Yes; recurring notice for known minors	Yes	Break reminders and restrictions on sexually explicit outputs to known minors	Annual report to Office of Suicide Prevention	Public enforcement plus a limited private civil action for injury in fact
Colorado	HB 26-1263	Signed May 29, 2026; effective August 12, 2026, with operative duties beginning January 1, 2027	Yes for covered minor interactions	Yes	Parental tools; restrictions involving sexual content, emotional dependence, and gamified engagement	Safety and self-harm reporting provisions; rulemaking underway	Attorney General under state consumer-protection law
Connecticut	SB 5, Public Act 26-15	Companion provisions begin January 1, 2027	Yes when a reasonable user could mistake the system for a human	Yes, including crisis-resource referral	Additional safeguards involving violence, disordered eating, substances, sexual exploitation, and parental management	Recordkeeping and related statutory duties vary by provision	Attorney General; unfair-trade-practice framework
Georgia	SB 540	Effective January 1, 2027	Yes	Yes	Restrictions and privacy tools for minor users	No general annual agency report identified	Attorney General; civil penalties
Hawaii	SB 3001, Act 248	Enacted and effective July 14, 2026	Yes	Yes	Additional protections for minor account holders	Annual reports to the Behavioral Health Administration	Violations treated as unfair or deceptive practices
Idaho	S 1297, Conversational AI Safety Act	Effective July 1, 2027	Yes	Yes	Restrictions on addictive rewards, sexual content, simulated emotional dependence, and certain role play; privacy tools	No general annual agency report identified in the enacted act	Attorney General; no private right of action
Iowa	SF 2417	Effective July 1, 2027	Yes	Yes	Minor protections and restrictions on presenting the service as professional mental or behavioral health care	No general annual agency report identified	Attorney General and civil penalties
Nebraska	LB 525, Conversational Artificial Intelligence Safety Act	Effective July 1, 2027	Yes	Yes	Restrictions on rewards, sexual content, sentience or human claims, emotional dependence, and adult-minor romantic role play; privacy tools	No general annual agency report identified	Attorney General; no private right of action; model-developer limitation for third-party operator conduct
New York	General Business Law Article 47	In effect	Yes; recurring notice every three hours of continued use	Yes	The enacted Article 47 framework is less prescriptive than several 2026 minor-safety laws	Operator records support Attorney General oversight	Attorney General; civil penalties support suicide-prevention programs
Oregon	SB 1546, Chapter 85	Effective January 1, 2027	Yes	Yes	Additional protocols when the operator has reason to believe the user is a minor	Annual reporting concerning crisis-resource referrals	Private right of action for ascertainable harm, damages, and injunctive relief
Rhode Island	S 2195/H 7350 companion measures	Effective January 1, 2027	The principal enacted measure centers on crisis response rather than a broad recurring disclosure regime	Yes, including possible physical harm to others	Limited compared with states that regulate minor-facing engagement design	Annual reports to the Attorney General; aggregate publication	Attorney General; penalties up to $15,000 per day
Washington	HB 2225	Effective January 1, 2027	Yes	Yes	Restrictions on sexual content and manipulative engagement, including emotional dependence, isolation, secrecy, and spending pressure	Public safety-protocol reporting requirements	State consumer-protection enforcement and statutory remedies

The table is a screening tool, not a substitute for reading the statute. Coverage can turn on how a service is marketed, whether it sustains a relationship across interactions, whether the operator knows or should know that a user is a minor, and whether an ordinary transactional chatbot is excluded.

What These Laws Have In Common

Most states start with nonhuman notice

Most of the laws require some form of clear notice that the user is interacting with AI rather than a person. The timing differs. Some states focus on the beginning of the interaction. Others require repeated notices, especially for minors or extended sessions.

Writing the notice is the easy part. Companies still need to decide which products qualify, where the notice appears, whether it follows the user across devices, and what records show that it was delivered.

Crisis response is now part of product compliance

Hawaii joins a growing group of states requiring protocols for suicidal ideation or self-harm. These provisions commonly require the operator to identify covered expressions and direct the user to an appropriate crisis service.

The statutes do not all use the same trigger or prescribe the same response. A national program needs a documented detection standard, escalation logic, referral content, testing process, and review owner.

The minor protections reach beyond age gates

Several 2026 laws regulate what the chatbot may say or do after a minor enters the product. Common subjects include sexually explicit material, simulated romantic or dependent relationships, addictive reward systems, isolation from family or friends, secrecy, spending pressure, and design intended to prolong use.

Age assurance is one part of the problem. Operators also need a defensible way to apply the correct experience when they know, or have reason to know, that a user is a minor.

Reporting and remedies vary sharply

Hawaii requires annual reporting to its Behavioral Health Administration. California, Oregon, and Rhode Island also use reporting mechanisms, but the recipients and required data differ. New York relies on Attorney General enforcement. Oregon adds a private action. California provides a separate limited civil remedy. Idaho and Nebraska expressly reject a private right of action.

These differences affect records, litigation exposure, incident review, and contract allocation. A generic safety policy will not cover all of them.

Why Hawaii Act 248 Matters

Hawaii’s Act 248 puts several recurring duties in one law: nonhuman disclosure, suicide and self-harm protocols, protections for minor account holders, annual reporting, and unfair-or-deceptive-practice enforcement.

Hawaii also shows how far this issue has moved beyond California and New York. A company offering one national product may face similar duties through different state statutes, agencies, and enforcement routes.

Laws That Are Related But Not Direct Equivalents

Several enacted laws belong in the same risk review without fitting neatly into the main comparison:

New York’s Safe By Design Act addresses child accounts on online platforms and disables integrated AI chatbots by default, subject to parental controls.
South Carolina’s H 3431 is a broader minors’ online-safety and reasonable-care statute rather than a dedicated companion-chatbot law.
Wyoming’s HB 102 targets intentionally designed or distributed systems involving specified self-harm promotion and sexual deepfake harms, with a narrower and more punitive structure.
Maine and Utah regulate aspects of AI-delivered therapy, mental-health representations, or professional services.
Rhode Island separately enacted restrictions involving AI and mental-health care.

These measures can affect the same product or vendor review, but they should not be described as interchangeable with Hawaii’s Act 248.

Pending Measures

Pending bills belong in a separate watchlist. They do not create current compliance duties.

New York’s S 9051-B/A 10379 passed both legislative chambers in 2026 and would impose additional minor-facing companion safeguards. Its provisions should not be treated as enacted unless the governor signs it or it otherwise becomes law.

Other states continue to consider bills addressing age assurance, parental consent, sexual content, emotional dependence, professional impersonation, and crisis response. This guide will move a state into the main table only after enactment can be confirmed through an official source.

A Practical Multistate Review

Companies offering emotionally responsive, relationship-oriented, or highly personalized conversational AI should be able to answer:

Which products fall within each state’s companion or conversational-AI definition?
Which ordinary business, customer-service, productivity, or professional tools are excluded?
Where and how often does the product disclose that it is AI?
How does the product detect and respond to suicide, self-harm, or threats of violence?
What changes when the user is known or reasonably believed to be a minor?
Which engagement, sexual-content, role-play, or spending features must be disabled?
What must be reported, to whom, and on what schedule?
Which duties belong to the operator, model developer, distributor, or contracting customer?
What evidence shows that safeguards were tested and notices were delivered?
Which states permit private claims in addition to government enforcement?

Start with a product inventory tied to the state definitions. Then build a control matrix that assigns each duty to an owner and records the supporting evidence, effective date, and reporting deadline.

Sources

This guide is general information, not legal advice. Statutory text, amendments, effective dates, rules, and official guidance should be checked for each product and jurisdiction.