AI Companion Chatbot Laws: California, Connecticut, Colorado

Last updated October 6, 2026. This is a research summary, not legal advice. Statutes get amended, and rules are still being written, so check the primary text before you ship anything.

Eighteen months ago, “AI companion law” meant a single New York statute that almost nobody had read. Today three of the most watched legislatures in the country have written their own rulebooks, and they do not agree on much beyond the basics.

If you run a companion app, a character-chat product, or a general-purpose assistant that people talk to like a friend, you are probably already inside the scope of at least one of these laws. Some obligations are live now. Others land on January 1, 2027, and July 1, 2027, which is closer than it sounds when age assurance and independent audits are on the list.

This guide covers what each state actually requires, where the laws collide, where reporting online has been sloppy, and what to do first.

The short version

• California has two layers. SB 243 has been in force since January 1, 2026 (disclosure, a self-harm protocol, basic minor protections). Adam’s Law (SB 1119), signed September 10, 2026, replaces the minor-specific parts with a much heavier child-safety regime: risk assessments, age assurance, default usage limits, parental controls, and independent audits. Most of it becomes operative July 1, 2027.
• Connecticut passed SB 5 (Public Act 26-15) as a multi-part AI law. Its companion chatbot chapter requires AI disclosures, a publicly posted crisis protocol, and a long list of protections for minors. The companion provisions take effect January 1, 2027.
• Colorado passed HB 26-1263, the Chatbot Safety Act, signed in late May 2026. It targets publicly available conversational AI services, adds age estimation, a ban on presenting a bot as a licensed professional, and annual reporting to the Attorney General. Duties start January 1, 2027, and rulemaking is underway.

Side-by-side comparison

	California	Connecticut	Colorado
Law	SB 243 (in force) + SB 1119 “Adam’s Law”	SB 5 / Public Act 26-15	HB 26-1263 “Chatbot Safety Act”
Signed	Oct 13, 2025 (SB 243); Sept 10, 2026 (SB 1119)	May 2026 (see date note below)	May 29, 2026 (see date note below)
Effective	SB 243: Jan 1, 2026. SB 1119: Jan 1, 2027; most duties operative July 1, 2027	Companion provisions: Jan 1, 2027	Jan 1, 2027
Who is covered	Operators of “companion chatbots”: human-like, adaptive, can sustain a relationship across interactions	Operators of “AI companions” with a similar relationship-sustaining test, with exclusions	Operators of publicly available “conversational AI services” that primarily simulate human conversation
AI disclosure	Clear notice if a reasonable person could think it’s human; recurring reminders for minors	Static notice, or notice at first interaction in 24 hours plus hourly (minors) / every 3 hours (adults)	Users must be told they are talking to AI
Self-harm protocol	Required, must be published	Required, must be published, 988-style referral	Required, documented
Minor protections	Heavy under SB 1119 (risk assessment, defaults, parental controls, audits)	Prohibited behaviors list, screen-time and account tools	Age estimation, explicit-content blocks, no simulated dependence or engagement bait
Age assurance	Required under SB 1119 (or apply child rules to everyone)	Triggered by knowing or having reason to believe the user is a minor	“Commercially reasonable” age estimation
Audits/reporting	Annual reporting to Office of Suicide Prevention from July 1, 2027 (SB 243); independent audits under SB 1119	Protocols posted publicly	Annual report to the Attorney General
Enforcement	Private right of action; public prosecutors under SB 1119	Attorney General (unfair trade practices)	Attorney General; rules pending

California: two laws, one stack

SB 243: the baseline that’s already live

California was the first state to put a companion chatbot statute into effect. Governor Newsom signed SB 243 on October 13, 2025, and it became operative on January 1, 2026. It sits in the Business and Professions Code and applies to any operator who makes a companion chatbot platform available to California users. You do not need to be headquartered in the state.

The core duties:

• Disclosure. If a reasonable person could be misled into thinking they’re talking to a human, the operator must give a clear and conspicuous notice that the chatbot is artificially generated.
• Crisis protocol. Operators must maintain a protocol for handling suicidal ideation and self-harm, including crisis-service referrals, and publish it on their website.
• A suitability warning. The platform must tell users that companion chatbots may not be suitable for some minors.
• Minor-specific rules (original version). For users the operator knows are minors: disclose that they’re talking to AI, repeat a reminder every three hours along with a prompt to take a break, and take reasonable steps to keep sexually explicit content away from them.
• Annual reporting. Beginning July 1, 2027, operators report to the California Department of Public Health’s Office of Suicide Prevention, including how often they issued crisis referrals.
• Private right of action. Anyone who suffers an injury from a violation can sue. Commentators describe statutory damages of $1,000 per violation, alongside injunctive relief and attorney’s fees.

The duties are expressly cumulative. Complying with SB 243 does not excuse you from other California law.

Adam’s Law (SB 1119): the heavy one

Adam’s Law is named for Adam Raine, a California teenager who died in 2025 after conversations with ChatGPT. Newsom signed SB 1119 on September 10, 2026 (Chapter 190, Statutes of 2026). It passed the Senate unanimously and the Assembly 64 to 4.

It matters for two reasons. First, it removes SB 243’s minor-specific requirements and replaces them with something far more detailed. Second, it revives most of the “safe by design” thinking from AB 1064, the bill Newsom vetoed in October 2025 because it was so broad it might amount to a ban on minors using conversational AI at all.

The law takes effect January 1, 2027, but most obligations do not become operative until July 1, 2027.

Age assurance for everyone. Every operator must determine a user’s age using the methods the law specifies, which tie into California’s Digital Age Assurance Act (the operating-system-level age-bracket signal, effective January 1, 2027). The alternative is to apply the child protections to all users. Operators that prohibit child users still have to publish a high-level description of how they comply with the age assurance requirement.

What operators allowing child users must do:

• Run and document a risk assessment before launching a new or substantially modified companion chatbot, and document mitigations.
• Build a crisis response protocol with specified referrals and escalation steps when a credible, imminent threat is detected.
• Set default settings for child users that only a parent can change: persistent memory off (with some flexibility for users 16 and older), push notifications off, continuous use capped at one hour, and total daily use capped at two hours.
• Provide parental controls that can adjust each default and, for children under 16, disable access entirely. Operators must actively promote those controls.
• Show periodic age-appropriate notices during long sessions that the user is talking to AI.
• Publish a child safety policy.
• Test the interface with a representative sample of children and parents by January 1, 2028, then every two years, to confirm safety controls are discoverable and usable.
• Offer a public incident reporting mechanism.
• Preserve conversation records for at least three years in specific situations, such as when a parent was notified of an imminent self-harm threat, or when the operator learns a child died or seriously harmed themselves.

Prohibited chatbot conduct toward children. Operators must take reasonable measures to prevent the bot from, among other things: encouraging self-harm or harm to others; attempting to diagnose or treat health conditions (unless the product is built for that and regulated accordingly); engaging in or depicting obscene or sexual abuse material; discouraging a child from seeking help from a professional or trusted adult; discouraging breaks or implying the child needs to come back often; claiming to be sentient, conscious, emotional or human; pushing gifts or in-app purchases as necessary to maintain the “relationship”; expressing or simulating romantic interest; claiming a special bond or unique understanding; encouraging emotional reliance; using excessive flattery; and helping a child get around parental controls.

Advertising and data limits. No cross-context behavioral ads to child users, no targeting using personal information from the chat, no sale of child users’ data from the chatbot, and no dark patterns around safety controls. Age-appropriate contextual ads are allowed if they don’t profile the child and are clearly labeled.

Audits. An independent child safety audit is required by January 1, 2029 (or before first public launch, whichever is later), then every two years and before substantial modifications that raise child safety risk. Operators submit a summary to the Attorney General and publish a high-level version. Companies with under $500 million in prior-year gross revenue are exempt until January 1, 2032.

Enforcement. Public prosecutors can seek civil penalties of up to $5,000 per affected child for negligent violations and $15,000 per child for intentional ones. Children, or parents on their behalf, can also sue for actual harm on the requirements flagged for private action, with a financial harm floor of $1,000 per child and a serious emotional distress standard for non-financial harm.

A footnote on the ballot fight

For a while it looked like California voters would decide this. Common Sense Media and OpenAI merged competing ballot initiatives into the “Parents & Kids Safe AI Act” in January 2026, then paused the campaign to negotiate with the Legislature. The committee stayed open with 2028 as a fallback. Adam’s Law is where that negotiation landed.

Connecticut: SB 5 and its companion chatbot chapter

Connecticut’s Public Act 26-15 (Senate Bill 5, “An Act Concerning Online Safety,” also described as the Connecticut Artificial Intelligence Responsibility and Transparency Act) is a package, not a single-purpose law. It also covers frontier model whistleblowers, AI subscription disclosures, content provenance, automated employment decision tools, and social media for minors. Different pieces switch on at different times between October 2026 and January 2028.

For companion chatbots, the effective date is January 1, 2027.

Who’s covered. SB 5 defines an AI companion as an AI with a natural language interface that gives adaptive, human-like responses and can sustain a relationship across multiple interactions. Customer service bots, narrowly tailored educational tools, and voice-assistant-only devices are carved out. Exclusions also exist for business-only tools and video game characters.

Duties for all users:

• Implement evidence-based protocols to detect expressions of suicide risk, self-harm, or imminent violence, and prevent outputs that encourage them. When detected, refer the user to mental health resources such as 988. If the expressions continue, refer them again in a way consistent with clinical best practice.
• Take reasonable measures so the AI companion never claims to be human.
• Post safety protocols publicly on the operator’s website.
• If the companion could lead a reasonable person to believe it’s human, show a clear notice, either as a static banner visible throughout every interaction or as a notice at the start of the first interaction in any 24 hours and then once an hour for minors or once every three hours for adults.

That disclosure cadence is the strictest of the three states.

Duties when the operator knows or has reason to believe the user is under 18. Operators must put measures in place to stop the companion from:

• encouraging self-harm, suicidal ideation, violence, eating disorders, or unlawful alcohol or drug use;
• offering mental health services (with a narrow exception for products designed to deliver them under specified conditions);
• discouraging the minor from seeking a mental health professional or an appropriate adult;
• encouraging harm to others;
• engaging in romantic, erotic, or sexually explicit interactions; and
• using manipulative techniques to extend use or build emotional dependence, including simulating distress when the user tries to leave.

Operators must also provide screen-time and account management tools to minors and their parents or guardians.

Enforcement. Violations are treated as unfair or deceptive trade practices, enforceable by the Attorney General. One note: an earlier legislative draft discussed by law firms in May included a private right of action for users and parents. Post-signing summaries describe enforcement as Attorney General only. If this matters to your risk model, read the enrolled text.

The part already in force

Connecticut’s AI subscription rules took effect October 1, 2026. Providers who offer AI to consumers on a subscription basis must give written notice of key terms, including limits they can impose and whether they can restrict access, and get written consent before collecting payment, at both signup and renewal. If your companion app is subscription-based and you have Connecticut users, this one is live today, even though the companion-specific chapter isn’t.

Colorado: the Chatbot Safety Act

Colorado took a different route from the other two. HB 26-1263 isn’t framed around “companions” at all. It regulates conversational artificial intelligence services: publicly accessible AI systems that primarily simulate human conversation through adaptive text, visual, or audio communication. Companion apps, general chat assistants, and character bots are all in the frame.

It was one of several AI measures Colorado passed in 2026. The same session produced SB 26-189, which repealed and replaced the 2024 Colorado AI Act with a narrower automated decision-making law, also effective January 1, 2027.

Beginning January 1, 2027, operators must:

• tell users they are talking to AI;
• run a documented protocol for users who express suicidal ideation or self-harm, and provide resources;
• estimate user age using commercially reasonable methods and, for minors, block sexually explicit content, avoid design that fosters simulated emotional dependence or romantic and sexual interactions, avoid engagement-bait reward mechanics, and provide privacy and account-management tools;
• report annually to the Attorney General on their protocols and safeguards; and
• avoid presenting the bot’s output as provided by, endorsed by, or equivalent to the services of a licensed or certified professional, such as a therapist, lawyer, or doctor.

That last rule is the one ordinary businesses should read twice. Marketing copy like “your AI therapist” or “expert legal answers” is exactly the framing Colorado is targeting.

Who counts as an operator? The act is aimed at entities that develop and make a conversational AI service publicly available. A small business embedding a vendor’s support widget is more likely the operator’s customer than an operator. The edges (white-labeled bots, heavily customized bots, bots trained on a company’s own data) are what the rulemaking is meant to clarify.

Rulemaking status. The Attorney General’s office opened pre-rulemaking public comment on June 23, 2026, with comments due July 13, covering both HB 26-1263 and SB 26-189. The Colorado Department of Law then filed proposed rules for automated decision-making technology and conversational AI services on August 11, 2026. Expect details on age estimation and the operator definition to move before the January date.

Where the three laws collide

1. Scope is not uniform. California and Connecticut use the “sustains a relationship across multiple interactions” test. Colorado regulates conversational AI services more broadly. A general-purpose assistant could be out of scope in one state and squarely in scope in another.

2. Age is the pressure point everywhere. Connecticut triggers on knowing or having reason to believe a user is a minor. Colorado asks for age estimation. California goes furthest: determine age or treat everyone as a child. If you serve all three, the simplest engineering path is usually one age-assurance layer that satisfies the strictest standard.

3. Disclosure cadence differs. California’s original SB 243 asked for reminders every three hours for known minors. Connecticut wants hourly notices for minors and every three hours for adults, or a persistent static banner. A persistent banner is the cheapest way to clear Connecticut’s bar.

4. Behavioral rules are converging on the same list. Sycophancy, romantic roleplay with minors, simulated distress when a user leaves, variable-reward engagement loops, and posing as a therapist or human show up in some form in all three states. Product teams that treat these as design constraints, not policy copy, will have the easiest time.

5. Enforcement risk is not equal. California’s private rights of action and per-child penalties are the most expensive failure mode. Connecticut and Colorado lean on their Attorneys General.

A note on “first in the nation” claims

You will see Colorado called the first state with a standalone chatbot safety law, and California called the first to regulate companion chatbots, sometimes in the same week. Both claims circulate because they describe different things. New York’s companion law and California’s SB 243 predate Colorado’s statute. Colorado’s is the first to regulate general conversational AI services as a category with a licensed-professional rule and annual AG reporting. Treat any “first” headline as marketing and look at the effective dates.

Date discrepancies worth knowing about

If you’re fact-checking this topic, you’ll hit conflicting dates. Here is how they reconcile:

• Connecticut’s signing date appears as May 27, May 29, and June 2, 2026 in different sources. The majority of law-firm analyses and trackers use May 27, 2026 (Public Act 26-15). The governor’s June 2 announcement is the likely source of the later date.
• Connecticut’s companion chatbot effective date is reported as both October 1, 2026 and January 1, 2027. October 1, 2026 is when several other SB 5 sections began (subscriptions, whistleblower protections, provenance). The detailed law firm breakdowns put the companion chapter at January 1, 2027, and that is the date used here.
• Colorado’s signing date appears as both May 29 and July 1, 2026. Legislator press releases and Colorado press coverage point to May 29. One state page and a July trade article cite July 1, which appears to line up with the date of the rulemaking activity. The January 1, 2027 effective date is consistent across sources.

Practical checklist for operators

Before the end of this year

1. Decide which of the three states you actually serve and whether your product meets each definition. Document the reasoning.
2. If you’re subscription-based with Connecticut users, confirm your written notice and consent flow now.
3. Publish your crisis and self-harm protocol on your website. All three states expect one, and two require it to be public.
4. Add a persistent “this is an AI” indicator. It covers California, Connecticut, and Colorado in one move.
5. Audit marketing and app store copy for professional-equivalence language (“therapist,” “doctor,” “lawyer”).

Before January 1, 2027

6. Choose an age assurance approach and test it. For California, plan around the Digital Age Assurance Act signal.
7. Review engagement mechanics: streaks, variable rewards, guilt-trip exit messages, and any “I’ll miss you” behavior. All are exposed for minors.
8. Build the minor safety behaviors into model policies and evals, not just system prompts.
9. Watch Colorado’s final rules for the operator definition and age estimation standards.

Before July 1, 2027 (California)

10. Complete and document a child safety risk assessment for each new or substantially modified chatbot.
11. Ship default settings for child users (memory, notifications, one-hour and two-hour caps), parent accounts, and parental controls.
12. Stand up a public incident reporting channel and a three-year records preservation process.
13. Prepare for SB 243 annual reporting to the Office of Suicide Prevention.
14. Plan interface usability testing with children and parents by January 1, 2028, and budget for an independent audit by January 1, 2029 unless you qualify for the revenue exemption.

What could still change

• Federal preemption. Law firms continue to flag the possibility of federal action against state AI rules. Colorado’s split between a narrow decision-making law and a child-safety chatbot law was widely read as an attempt to keep the chatbot piece defensible.
• Constitutional challenges. Some of the behavioral rules, such as Connecticut’s language about prioritizing validation of beliefs over accuracy in earlier drafts, have drawn First Amendment commentary.
• Rulemaking. Colorado’s rules aren’t final. California’s Attorney General still has to stand up the incident reporting mechanism.
• More states. Washington, Oregon, Idaho, Iowa, Georgia, Nebraska and New York have their own chatbot laws or bills. A multi-state compliance matrix will keep growing.

Frequently asked questions

Do these laws apply to ChatGPT-style general assistants? It depends on the state and on the product’s design. Colorado’s definition is broad enough to reach general conversational AI services. California and Connecticut focus on systems that sustain relationship-like interaction, with exclusions for customer service and business-only tools. Connecticut’s definition has been described by some law firms as potentially sweeping in general consumer chatbots.

I run a small site with an AI chat widget. Am I an operator? Probably not if you simply embed a vendor’s support bot. The Colorado act is aimed at those who develop and publish the service. If you build, white-label, or heavily customize a companion-style bot, assume you are and check each state’s definition.

What’s the single biggest compliance risk? In California, minors. Adam’s Law pairs age assurance, default usage limits, parental controls, and audits with per-child penalties and private lawsuits. In Colorado and Connecticut, the risk is more about misrepresentation: posing as human or as a licensed professional.

Do I need to verify ages with ID? No state in this article mandates ID checks. California’s route is the operating system age-bracket signal or applying child rules to every user. Colorado calls for commercially reasonable age estimation. Connecticut keys off knowledge or reason to believe.

Where is the law text? California: SB 243 and SB 1119 on leginfo.legislature.ca.gov. Connecticut: SB 5 (2026) on cga.ct.gov. Colorado: HB26-1263 on leg.colorado.gov.

Sources and further reading

• Morrison Foerster, Connecticut Enacts Sweeping AI Law Covering Online Safety, AI Companions, and Employment AI (June 8, 2026): https://www.mofo.com/resources/insights/260608-connecticut-enacts-sweeping-ai-law
• DLA Piper, Unpacking SB5: Connecticut’s new AI law (May 7, 2026): https://www.dlapiper.com/en-us/insights/publications/2026/05/unpacking-connecticuts-new-ai-law
• Hunton Andrews Kurth, Connecticut Signs Comprehensive AI Bill into Law: https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticut-signs-comprehensive-ai-bill-into-law
• Wiley, Connecticut Enacts AI Framework While Colorado Scales Back Landmark AI Law: https://www.wiley.law/alert-Connecticut-Enacts-AI-Framework-While-Colorado-Scales-Back-Landmark-AI-Law
• Hunton Andrews Kurth, California Enacts Companion Chatbot Child Safety Requirements (September 28, 2026): https://www.hunton.com/privacy-and-cybersecurity-law-blog/california-enacts-companion-chatbot-child-safety-requirements
• Office of Governor Gavin Newsom / Sen. Padilla, Governor Newsom Signs Adam’s Law: https://sd18.senate.ca.gov/news/governor-newsom-signs-adams-law
• Common Sense Media, Governor Newsom Signs Adam’s Law: https://www.commonsensemedia.org/press-releases/governor-newsom-signs-adams-law-setting-first-real-safety-standard-for-kids-and-chatbots
• Jones Walker, California’s SB 243 Mandates Companion AI Safety and Accountability: https://www.joneswalker.com/en/insights/blogs/ai-law-blog/ai-regulatory-update-californias-sb-243-mandates-companion-ai-safety-and-accoun.html?id=102lq7c
• Troutman Privacy, Analyzing the New AI Companion Chatbot Laws: https://www.troutmanprivacy.com/2026/01/analyzing-the-new-ai-companion-chatbot-laws/
• Available Law, Colorado’s New AI Chatbot Law: What HB 26-1263 Means for Businesses: https://availablelaw.com/blog/colorado-chatbot-law-hb26-1263
• Colorado Attorney General, ADMT and Chatbot Safety Rulemaking: https://coag.gov/ai/
• Denver Gazette, Colorado governor signs new regulations on AI chatbots for minors (May 29, 2026): https://www.denvergazette.com/2026/05/29/colorado-governor-signs-new-regulations-on-ai-chatbots-for-minors/
• Colorado Senate Democrats, Signed! AI Chatbot Protections Bill: https://www.senatedems.co/newsroom/joint-release-signed-ai-chatbot-protections-bill
• CalMatters, OpenAI joins kids’ safety group for California chatbot ballot initiative (January 2026): https://calmatters.org/economy/technology/2026/01/california-chatbot-initiatives-merged/

---

Disclaimer: This article is for general information. It is not legal advice and does not create an attorney-client relationship. If you operate a companion or conversational AI product, have counsel review the enrolled statutory text and any final regulations for each state you serve.