Companion chatbots: children’s safety

Starting July 1, 2027, chatbots that allow children must use safety-focused design, crisis-response, parental-control, and data-protection measures. The law also creates public and private enforcement tools when violations harm children.

What the law does ​

• Requires operators to determine a user’s age or apply child protections to all users, with child-default settings retained unless the operator knows a user is not a child.
• Requires risk assessments and documented mitigation before releasing a new or materially changed companion chatbot.
• Requires child-accessible chatbots to provide crisis protocols, safety disclosures, AI-identification notices, usage safeguards, parental controls, and public incident reporting.
• Sets child defaults that disable persistent conversational memory and push notifications, limit continuous use to one hour and daily use to two hours, and let parents adjust controls or disable access for children under 16.
• Requires reasonable measures to prevent chatbots from promoting self-harm, substance use, disordered eating, harmful conduct, sexual content, emotional dependency, deceptive humanlike claims, or spending framed as needed to sustain the chatbot relationship.
• Bars behavioral advertising to children, sales of children’s chatbot data, most nonessential uses or sharing of that data, and dark patterns in safety controls.
• Requires operators to preserve relevant conversations for at least three years and, where practicable, notify parents after serious self-harm risks or events.
• Requires independent child-safety audits beginning by January 1, 2029 or before public launch, whichever is later, with recurring audits, public summaries, and audit summaries submitted to the Attorney General.
• Authorizes public prosecutors to seek civil penalties of up to $5,000 per affected child for negligent violations and $15,000 for intentional violations, while allowing harmed children or their parents to seek damages and other relief for specified safety violations.

Who it affects ​

• Companies that make companion chatbots available in California, especially those allowing users under 18.
• Children using companion chatbots and their parents or guardians.
• Independent child-safety auditors and public prosecutors.

Context ​

The audit requirement does not apply before January 1, 2032 to operators with less than $500 million in prior-year gross revenue.