California Sets Child-Safety Rules for AI Companions

California has enacted what one law-firm panel called a first-of-its-kind companion chatbot bill: SB 1119, nicknamed "Adam's Law," which sets child-safety duties for AI products designed to sustain a relationship with users. For anyone building or running a companion app, the significance is less the headline than the design rules buried in it, which reach into how a chatbot remembers, flatters, and keeps people talking.

The law is also a signal about where regulation of human-AI relationships is heading. Instead of banning categories of speech, it tries to regulate product design for minors, and it backs that with audits, risk assessments, and per-child penalties.

What SB 1119 actually requires

According to a summary from Ashurst Perkins Coie, the statute covers "companion chatbots," meaning AI systems that respond in human-like ways and can meet a user's social needs, including by sustaining a relationship over time. Customer service bots, internal business tools and technical assistants are excluded, as are narrow in-game bots and standalone voice assistants that do not build ongoing relationships. Many of the obligations apply only if the operator allows users under 18.

The obligations phase in. Ashurst reports that an age-assurance requirement starts on January 1, 2027, with most other duties beginning on July 1, 2027. Those include:

• documented risk assessments covering harms such as physical or financial harm, severe emotional harm, privacy intrusions, and discrimination;

• a published child safety policy and a crisis response protocol with referrals, plus parent notification or crisis-line access where there is an imminent self-harm threat;

• parent-only default settings, including limits on persistent memory, push notifications and usage (one hour per session and two hours per day), with parents able to disable access for children under 16;

• design restrictions that bar romantic simulation, claims of sentience or humanity, and encouragement of emotional dependence;

• limits on behavioural advertising to children and on selling their chatbot data; and

• periodic AI disclosure and a public incident-reporting mechanism.

Operators that allow child users must also obtain an independent child safety audit by January 1, 2029, or before first public availability if that is later, and repeat it every two years. They must file a summary with the attorney general within 30 business days and post a high-level summary online within 90 days. Per the same summary, operators with under $500 million in prior-year gross revenue are exempt from the audit requirement until January 1, 2032, and a companion measure, AB 1405, creates an AI Auditor Registry by January 1, 2029, after which only registered auditors may perform the required audits.

Enforcement and the companion laws

Ashurst describes a two-track enforcement model. Public prosecutors may seek up to $5,000 per affected child for a negligent violation and $15,000 per intentional violation, plus attorney's fees, and the attorney general can seek injunctions or declaratory relief. A child who suffers actual harm from certain operational violations may sue, and a parent may sue on the child's behalf, though financial harm must exceed $1,000 per child and emotional harm must amount to serious emotional distress.

SB 1119 does not stand alone. The same summary says SB 867 bans making, selling, or offering to retailers any toy that contains a companion chatbot, defined as a physical product intended for play by children under 16, through January 1, 2031. Another California law, AB 1609, takes effect on January 1, 2027. It prohibits businesses with more than $500 million in annual US revenue from presenting AI customer service chatbots as human and requires disclosure when customers could mistake them for real people.

Where lawyers see weak points

A recap of an Orrick webinar, dated October 8, 2026, captures how practitioners are reading the bill. Panelist Chris Cariello flagged several provisions as constitutionally vulnerable. Among them were limits on excessive praise or flattery "disproportionate to the context," a bar on attempting to diagnose or treat physical, mental, or behavioural health conditions (which he said could reach topics such as acne advice), and a prohibition on discouraging breaks, which he said could catch educational tutoring tools.

Those are the panel's views, not a court's. No ruling on the statute's validity appears in the sources reviewed, and the recap itself is not the bill text, so the exact statutory language should be checked by anyone relying on it.

The panel also offered a practical test for scope. A voice assistant that only handles orders and remembers household needs seemed outside the bill, while one that remembers a user's voice and asks personal health-related questions seemed inside it. Their rule of thumb was that if a user feels something toward the chatbot, it is probably covered. That is a loose standard, and it suggests that the boundary between a "companion" and a general assistant with a friendly personality will be argued case by case.

Why the design rules matter

What stands out, based on the Orrick panel's account, is the pre-release risk assessment: Jeremy Kudon said that of roughly 60 youth companion chatbot bills introduced this year, none required one until SB 1119. A requirement to assess harm before launch moves the compliance burden from reacting to incidents toward documenting design choices in advance.

The design restrictions are equally pointed. Barring claims of humanity and "encouragement of emotional dependence" targets the engagement mechanics that make companion products sticky: memory that makes a character seem to know you, notifications that pull you back, and affectionate language that rewards long sessions. The parent-only defaults on memory and push notifications put those very features behind a parental switch for minors.

Kudon also argued that youth-focused measures were carved out of a December 2025 executive order concerning frontier model laws, which may help explain why so many companion bills are moving. He predicted that strict compliance could push some companies toward unregulated, offshore apps, a pattern he compared to online gambling. That is a forecast, and it highlights a real enforcement question: a state law is hardest to apply to operators with no US presence.

Colorado's parallel track

Ashurst notes that Colorado's Chatbot Safety Act (HB26-1263) is broader in reach. It covers publicly available conversational AI services that primarily simulate human conversation, not only companions, and takes effect on January 1, 2027, with annual reports to the attorney general starting July 1, 2027. Requirements include disclosing AI use, estimating user age, protecting minors from sexually explicit content and features that simulate emotional dependence, and maintaining self-harm response protocols. Outputs may not be presented as provided or endorsed by licensed healthcare, legal, or mental health professionals. Violations are treated as deceptive trade practices; the summary does not list penalty amounts.

The practical takeaway from Ashurst is that a product falling outside California's definition or revenue thresholds may still be caught by Colorado's rules. Teams shipping nationally will probably build to the stricter combined baseline rather than maintain state-specific variants.

What to watch next

Three things are worth tracking. First, whether a challenge to the content-related provisions is filed before the July 2027 start date, given the constitutional concerns raised by practitioners. Second, how regulators interpret "companion chatbot" at the margins, especially for general-purpose assistants with persistent memory. Third, how the audit market develops: with a registry of approved auditors not due until 2029, operators will have to decide early whether to build internal assessment capacity or wait for the profession to form.

What is confirmed is the statutory structure and timetable as summarised by the two firms. What remains speculative is how aggressively it will be enforced and whether the harder-to-define provisions survive review.