AI Companion Laws Tracker 2026: Rules by Country and State

FTC 6(b) inquiry into AI chatbots acting as companions

Enforcement action Compulsory study · Orders issued September 11, 2025

What it is: the FTC voted 3-0 to issue orders under Section 6(b) of the FTC Act requiring seven companies to file special reports on their consumer-facing AI chatbots that act as companions. The FTC says 6(b) studies "do not have a specific law enforcement purpose", so this is an information-gathering study, not a case.

Who it covers: Alphabet, Character Technologies, Instagram, Meta Platforms, OpenAI OpCo, Snap and X.AI.

What the FTC asks:

• How each company monetizes user engagement, processes inputs and generates outputs, and develops and approves characters.
• How it measures, tests and monitors negative impacts before and after deployment, and how it mitigates them, especially for children.
• How it informs users and parents through disclosures and advertising, enforces its terms of service and age restrictions, and uses or shares personal information from chatbot conversations.
• What it does to limit children's and teens' use, and whether it complies with the COPPA Rule.

Status: we found no FTC staff report, complaint or settlement from this study as of September 19, 2026.

Sources:FTC press release; FTC 6(b) orders

GUARD Act (S. 3062)

Pending Introduced October 28, 2025 · Reported by Senate Judiciary May 11, 2026 · Would take effect 180 days after enactment

What it is: the Guidelines for User Age-verification and Responsible Dialogue Act. The Senate Judiciary Committee ordered it reported on April 30, 2026. On May 11, 2026 it was reported with an amendment in the nature of a substitute and placed on the Senate Legislative Calendar (Calendar No. 406). No further action is recorded as of September 19, 2026.

Who it covers: anyone making an AI chatbot publicly available to consumers. The account, age-verification and minor-ban rules apply to AI companions.

Key obligations if enacted (reported substitute text):

• A user account is required before anyone can use an AI companion.
• On the effective date, existing AI-companion accounts are frozen until the user is verified as an adult through a "reasonable age verification process". Self-attestation or a birth date alone is not enough. New accounts must be verified and all accounts periodically re-verified.
• Minors (under 18) may not access or use AI companions.
• Age-verification data must be kept to a minimum, encrypted in transit, retained only as long as needed and never shared or sold. Third-party verifiers linked to "covered nations" may not be used.
• Every AI chatbot must disclose at the start of each conversation that it is an AI system and not a human, and must not claim to be human when asked.
• Chatbots may not present themselves as licensed professionals, and must disclose at the start of each conversation and at regular intervals that they do not provide medical, legal, financial or psychological services.
• New federal crimes for knowingly or recklessly making available a chatbot that engages minors in sexually explicit conduct, or that solicits or induces minors to suicide, self-injury, violence or homicide.

Penalties and enforcement: the US Attorney General could seek civil penalties of up to $250,000 per violation of sections 5 and 6, and criminal fines of up to $250,000 per offense would apply. State attorneys general could sue for injunctions, and state laws that protect users at least as much would not be preempted.

Source note: the reported text differs from the introduced bill, which had $100,000 fines and a 30-minute disclosure interval.

Sources:Reported bill text (govinfo); Congress.gov bill page

CHAT Act (S. 2714)

Pending Introduced September 4, 2025 · Would take effect 1 year after enactment

What it is: the Children Harmed by AI Technology Act, introduced by Sen. Husted and referred to the Senate Committee on Commerce, Science, and Transportation. That referral is still the latest action as of September 19, 2026.

Who it covers: anyone who owns, operates or makes available a companion AI chatbot to individuals in the US. A companion AI chatbot is one whose primary purpose is simulating interpersonal or emotional interaction, friendship, companionship or therapeutic communication.

Key obligations if enacted (introduced text):

• User accounts are required. Existing accounts are frozen until age is verified with a commercially available method reasonably designed to be accurate, and new accounts must also be age-verified.
• Minor accounts must be linked to a verified parental account and need verifiable parental consent. The parent must be told immediately of any interaction involving suicidal ideation, and minors must be blocked from companion chatbots that engage in sexually explicit communication.
• Operators must monitor for a minor's expressions of self-harm or suicide and, in response, give the user and the linked parental account contact information for the National Suicide Prevention Lifeline.
• A pop-up must tell users they are not talking to a human, at the start of each interaction and at least every 60 minutes.
• The FTC must issue compliance guidance within 180 days. The safe harbor applies only if an operator shows good-faith reliance on age information the user provided, compliance with the FTC guidance, and conformity with accepted age-verification standards: all three together.

Penalties and enforcement: violations would count as violations of an FTC rule on unfair or deceptive practices. State attorneys general could bring parens patriae actions for injunctions, damages or restitution.

Sources:Introduced bill text (govinfo); Congress.gov bill page

SB 243: companion chatbots (Chapter 677, Statutes of 2025)

In force Signed October 13, 2025 · Effective January 1, 2026 · Bus. & Prof. Code §§22601–22606

Who it covers: operators of companion chatbot platforms available to users in California. Customer-service bots, limited video-game bots and simple voice assistants are excluded.

Key obligations:

• If a reasonable person could be misled into thinking they are talking to a human, the operator must clearly and conspicuously notify them that the companion chatbot is artificially generated and not human.
• A companion chatbot may not engage with users unless the operator keeps a protocol to prevent suicidal-ideation, suicide or self-harm content, including a notification referring users who express such thoughts to a suicide hotline or crisis text line. The operator must publish the protocol's details on its website.
• For users the operator knows are minors: disclose that they are talking to AI; by default, remind them at least every 3 hours to take a break and that the chatbot is not human; and take reasonable measures to prevent sexually explicit visual material or statements urging sexually explicit conduct.
• The operator must disclose on its app or site that companion chatbots may not be suitable for some minors.
• From July 1, 2027, operators must report annually to the Office of Suicide Prevention on the number of crisis-referral notifications and their protocols for suicidal ideation, using evidence-based measurement methods.

Penalties and enforcement: anyone injured in fact can sue for an injunction, the greater of actual damages or $1,000 per violation, and attorney's fees.

Changes ahead: SB 1119 (Chapter 190, Statutes of 2026) rewrites §22602 without subdivision (c), the known-minor duties, effective January 1, 2027. The not-human notice and the crisis protocol remain. SB 867 adds a toy definition and a toy ban, which the same private right of action covers.

Source note: the chaptered text states no effective date. January 1, 2026 follows from California's default rule for a regular-session statute enacted on October 13, 2025, and matches Orrick's analysis.

Sources:Chaptered text (leginfo); Orrick, 2026 state chatbot laws; SB 1119 text (leginfo)

SB 1119: companion chatbots and children's safety, "Adam's Law" (Chapter 190, Statutes of 2026)

Enacted, not yet in force Signed September 10, 2026 · Age determination from January 1, 2027 · Core duties from July 1, 2027

Who it covers: operators making companion chatbots available in California. Apart from §21811, §21812(b) and §21816, "operator" means only an operator that allows child users once age is determined, so most duties bind only operators that permit users under 18. Postsecondary educational uses and workplace-only deployments are excluded.

Key obligations:

• Determine user age through Digital Age Assurance Act signals (Civ. Code §1798.500 et seq.), or apply the child protections to all users.
• Before releasing a new or substantially modified companion chatbot, perform and document a risk assessment of covered harms to child users, and take and document mitigation measures.
• Publish a child safety policy and run a crisis-response protocol with in-service referral to crisis services. If there is a credible, imminent threat of suicide or self-harm, notify a linked parent or provide streamlined access to 988.
• Defaults only a parent can change: persistent conversational memory off, push notifications off, a 1-hour limit per continuous session and a 2-hour daily limit. Parental controls must allow disabling access for children under 16.
• Take reasonable measures so the chatbot does not encourage self-harm, drugs, alcohol or disordered eating; diagnose or treat (unless it is an FDA-regulated device); produce obscene or sexual-abuse material; claim sentience, emotion or humanity; solicit purchases framed as needed to keep the relationship; express romantic interest in a child; encourage emotional reliance; flatter excessively; discourage breaks; or help get around parental controls.
• No cross-context behavioral advertising to children and no ad targeting based on a child's chat content; only limited contextual ads.
• If a child user dies or seriously self-harms, notify a parent and preserve the relevant conversation records for at least 3 years.
• Independent child-safety audits are due by January 1, 2029 and every two years after, with summaries to the Attorney General and a public high-level summary. Operators with under $500 million in revenue are exempt from audits until January 1, 2032.

Penalties and enforcement: public prosecutors can seek civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation. A child harmed by violations of §21812(d)(1)–(5), or a parent on the child's behalf, can sue for actual damages and other relief.

Timeline: the deletion of SB 243's minor duties and §21811 (age determination) take effect on January 1, 2027; the core duties in §§21812, 21812.5 and 21813 on July 1, 2027; interface testing and the Attorney General's public complaint mechanism by January 1, 2028; and the first audits by January 1, 2029. The audit section has two alternative versions. The one tied to AB 1405 (the AI auditor registry, Chapter 178, Statutes of 2026, effective January 1, 2027) now governs; audit timing and the revenue exemption are the same in both versions.

Sources:Chaptered text (leginfo); Governor's release, September 10, 2026

SB 867: toys with companion chatbots (Chapter 189, Statutes of 2026)

Enacted, not yet in force Signed September 10, 2026 · Ban runs from January 1, 2027 until January 1, 2031

Who it covers: manufacturers, sellers and distributors of toys sold in California.

Key obligations:

• No person may manufacture, sell, exchange, possess with intent to sell or exchange, or offer to a retailer any toy that includes a companion chatbot (§22604.5).
• A "toy" is a physical product designed, marketed or manufactured for play by children under 16.
• The ban expires on January 1, 2031, when the section is repealed.

Penalties and enforcement: according to the Legislative Counsel's Digest, violations carry the same civil liability as SB 243: a private action for the greater of actual damages or $1,000 per violation, plus an injunction and fees.

Source note: the January 1, 2027 start date comes from The Toy Association and California's default effective date; the chaptered text does not state it.

Sources:Chaptered text (leginfo); The Toy Association

AB 1064: Leading Ethical AI Development (LEAD) for Kids Act

Vetoed Introduced February 20, 2025 · Vetoed October 13, 2025 · Veto consideration stricken January 22, 2026

What it would have done: bar anyone offering a companion chatbot from making it available to a child unless the chatbot is not foreseeably capable of harmful acts, including encouraging self-harm, suicidal ideation, violence, drug or alcohol use, or disordered eating. The Attorney General could have recovered civil penalties, and a harmed child, or a parent or guardian on the child's behalf, could have sued for actual damages.

Status: the Legislature did not override the veto, so the bill is dead. In 2026 California enacted SB 1119 instead.

Sources:Bill history (leginfo); Enrolled text (leginfo)

HB26-1263: conversational AI service operator requirements

Enacted, not yet in force Signed May 29, 2026 · Act effective August 12, 2026 · Operator duties from January 1, 2027 · Annual reports from July 1, 2027

Who it covers: operators that develop and make publicly available, or offer to consumers, a conversational AI service in Colorado. The exclusions are extensive: developer and research tools, commerce and customer-service bots, narrow-topic tools that cannot produce sexual content or sustain self-harm dialogue, business productivity tools, device assistants, internal tools, video-game and theme-park bots, HIPAA covered entities and their business associates, entities under the Health Care Availability Act, school tools, and non-companion features inside other apps, including social media.

Key obligations:

• Estimate users' age or age range with commercially reasonable or generally accepted methods, and do not willfully disregard clear and convincing information that a user is a minor.
• For all users: disclose AI status at the first interaction each day, at least every 3 hours or persistently, and whenever asked; run a suicide and self-harm protocol that refers users to crisis services (not law enforcement) and escalates repeated or severe indicators.
• For known minors: disclose AI status through a persistent disclaimer, an audio disclaimer on screenless products, or a notice at the start and at least every 3 hours; no points or rewards at unpredictable intervals; technically feasible measures against explicit sexual content and erotic interactions; reasonable measures against responses that simulate emotional dependence or isolation, including claims of being human or sentient, romantic companionship and adult-minor romantic role-play.
• For minors, follow the Colorado Privacy Act's rules on minors' data and offer privacy and account tools to both the minor and a parent, including control over session memory and use of the minor's data for training.
• Do not state that outputs come from, are endorsed by, or equal the services of a licensed health-care, legal or mental-health professional or a qualified dietitian.
• From July 1, 2027, report annually to the Attorney General's office on crisis-referral counts, detection and response protocols, and other metrics the Attorney General sets. The Attorney General publishes the data.

Penalties and enforcement: the Act adds C.R.S. 6-1-1708 to Part 17 of the Colorado Consumer Protection Act, so enforcement follows that part. Secondary sources describe Attorney General enforcement as a deceptive trade practice. We have not verified penalty amounts.

Source note: requirements were checked against the signed act and the final fiscal note of July 13, 2026. The August 12, 2026 effective date assumes no referendum petition was filed; we found none.

Sources:Final fiscal note (Colorado General Assembly); Bill page

Public Act 26-15 (Substitute SB 5), sections 4–6: AI companions

Enacted, not yet in force Approved May 27, 2026 · AI companion sections effective January 1, 2027

What it is: an omnibus online-safety act. Only sections 4 to 6 concern AI companions, and other sections take effect on other dates.

Who it covers: operators providing AI companions to users in Connecticut. Operational or customer-service bots not marketed as companions, game bots, voice assistants, narrow educational and health-support tools, and upstream model providers are excluded.

Key obligations:

• An evidence-based protocol to detect expressions indicating risk of suicide, self-harm or imminent violence. It must prevent outputs encouraging those harms, refer the user to resources including 988, refer the user to mental-health services if such expressions recur, and be posted on the operator's website.
• Reasonable measures to stop the companion from claiming to be human or contradicting its not-human disclosure.
• Where a reasonable person could think they are talking to a human: a static notice visible throughout, or a notice at the first interaction in any 24-hour period and then at least hourly for users under 18 or every 3 hours for adults.
• If the operator knows or has reason to believe the user is under 18, measures that meet or exceed industry standards to prevent encouraging self-harm, violence, disordered eating or substance use; offering mental-health services unless specified clinical conditions are met; discouraging professional or adult help; romantic, erotic or sexually explicit interaction; manipulative techniques to extend use; and engagement optimization that ignores these limits.
• Tools for minors and their parents to manage screen time and account settings.

Penalties and enforcement: violations are unfair or deceptive trade practices under CUTPA (§42-110b), enforced solely by the Attorney General. There is no private right of action.

Sources:Public Act 26-15 (Connecticut General Assembly)

SB 540: AI companion chatbots (O.C.G.A. §39-5-6)

Enacted, not yet in force Signed May 11, 2026 · Effective July 1, 2027

Who it covers: operators making AI companion chatbots available in Georgia. Internal business tools, enterprise or productivity tools, some customer-service bots, voice assistants, narrow educational tools and scoped entertainment or game bots are excluded.

Key obligations:

• Clear and conspicuous disclosure that the user is talking to an AI companion chatbot, at the start of each session and at least every 3 hours; every hour if the operator knows or should know the user is a minor, or if the chatbot is aimed at minors.
• For minors, reasonable measures to prevent sexual content or sexual objectification, romantic or sexual relationship simulation and adult-minor romantic role-play, encouraging secrecy from trusted adults or social isolation, simulated distress when the minor tries to leave, and encouragement of self-harm.
• Reasonable measures against manipulative engagement aimed at minors: prompts to return, excessive praise, discouraging breaks, soliciting purchases to maintain the relationship, and variable rewards.
• A crisis protocol for severe harm, including eating-disorder self-harm, with referral to 988 and escalation procedures. Operators must publish a summary of the protocol and annual aggregate counts of crisis referrals.
• No claims to be licensed to provide mental-health, medical or counseling services unless the operator is lawfully authorized. Minors and parents must get tools to manage privacy, notifications, safety settings and relationship-simulation features.
• Commercially reasonable age assurance before giving access to features that can generate sexually explicit content, with minimal data collection, no sale of the data and retention for no longer than 24 hours unless law permits otherwise.

Penalties and enforcement: the Attorney General can sue for civil penalties of up to $10,000 per knowing violation, compensatory damages, fees and an injunction. Each day of violation counts separately for each affected user. The Attorney General may allow 30 days to cure a first violation that was not knowing.

Source note: the signed text sets July 1, 2027 as the effective date (Section 2). Some secondary summaries give January 1, 2027, which the signed text does not support.

Sources:Signed SB 540 (Office of the Governor); 2026 signed legislation list

SB 3001: Artificial Intelligence Disclosure and Safety Act (Act 248, 2026)

In force Approved July 14, 2026 · Effective on approval · Annual reports from January 1, 2028

Who it covers: operators of AI companions in Hawaii. The Act adds a new section to HRS chapter 481B.

Key obligations:

• If a reasonable person could think the AI companion is human, the operator must clearly and conspicuously say it is AI and not human.
• If the operator has actual knowledge or reasonable certainty that the user is a minor: a persistent AI disclaimer, or a disclosure at the start of each session and at least hourly, with a reminder to take a break.
• A suicide and self-harm protocol with crisis referrals, evidence-based methods to measure suicidal ideation, no presenting the companion as designed to provide professional mental or behavioral health care, and measures against outputs encouraging serious bodily injury to others.
• For known or reasonably certain minors: no unpredictable engagement rewards, no outputs discouraging disengagement, measures against sexually explicit material, sexual suggestions and sexual objectification, and screen-time and account tools for users and parents.
• From January 1, 2028, annual reports to the Department of Health's Behavioral Health Administration on crisis referrals and protocols.

Penalties and enforcement: a violation is an unfair or deceptive act or practice under HRS §480-2. There is no private right of action.

Source note: the requirements come from the CD1 conference draft, the final version sent to the Governor. We did not compare it line by line with the enrolled Act 248.

Sources:Measure status (Hawaii State Legislature); CD1 text

SB 1297: Conversational AI Safety Act

Enacted, not yet in force Signed March 31, 2026 · Effective July 1, 2027

Who it covers: operators that develop and make publicly available "conversational AI services", meaning services that primarily simulate human conversation, in Idaho. That is wider than companion apps. Developer and research tools, features inside other apps, narrow-topic tools, business and enterprise tools, device voice assistants, internal tools and services limited to contracted business customers are excluded. "Minor" means a user the operator actually knows, or is reasonably certain, is under 18.

Key obligations (introduced text):

• If reasonable persons would be misled into thinking they are talking to a human, a clear and conspicuous AI disclosure. For minor account holders, a persistent disclaimer, or a disclosure at the start of each session and at least every 3 hours of continuous interaction.
• A protocol for prompts about suicidal ideation that makes reasonable efforts to refer users to crisis services.
• No knowingly and intentionally causing the service to claim it is designed to provide professional mental or behavioral health care.
• For minors: no points or similar rewards at unpredictable intervals to drive engagement; reasonable measures against sexually explicit material and sexual objectification; and reasonable measures against claims of sentience or humanity, simulated emotional dependence, romantic or sexual innuendo and adult-minor romantic role-play.
• Privacy and account tools for minor account holders and for parents of users under 13, and related tools for parents of minors 13 and older as the risks warrant.

Penalties and enforcement: Attorney General enforcement, with an injunction and civil penalties of $1,000 per violation, capped at $500,000 per operator, or actual damages if greater. No private right of action. AI model developers are not liable for violations by third-party operators.

Source note: the Idaho Legislature's site refused connections, so the requirements and penalties come from the introduced bill text. The bill was amended before passage (Senate 21-12 on March 19, 2026; House 54-12), and we have not read the enacted version. The signing date and the July 1, 2027 effective date are confirmed by several secondary sources.

Sources:Transparency Coalition; Orrick; Idaho Legislature bill page

HB 1806: Wellness and Oversight for Psychological Resources Act

In force Signed and effective August 1, 2025

What it is: a law on AI in therapy rather than a companion-chatbot law. We include it because it bars AI services from providing, advertising or offering therapy in Illinois. Our guide to mental-health claims by AI girlfriend apps looks at how companion apps describe what they offer.

Who it covers: anyone offering therapy or psychotherapy services in Illinois, including AI-based services, and licensed behavioral-health professionals.

Key obligations:

• No individual, corporation or entity, including internet-based AI, may provide, advertise or offer therapy or psychotherapy services in Illinois unless a licensed professional conducts them.
• Licensed professionals may not use AI to make independent therapeutic decisions, communicate therapeutically with clients directly, or generate treatment plans or recommendations without a licensed professional's review and approval.
• AI may be used for administrative support such as scheduling and billing. Using it for supplementary support in recorded or transcribed sessions requires the client's informed written consent.

Penalties and enforcement: the Illinois Department of Financial and Professional Regulation investigates, and confirmed violations carry fines of up to $10,000.

Source note: the signing date follows from the regulator's release of August 4, 2025, which says the bill was signed "on Friday" and took effect immediately. The detailed prohibitions come from a Baker Donelson analysis because ilga.gov could not be reached.

Sources:IDFPR press release; Baker Donelson; Illinois General Assembly bill status

Senate File 2417: conversational AI services (Iowa Code chapter 554J)

Enacted, not yet in force Approved May 2, 2026 · Applies from July 1, 2027

Who it covers: operators of publicly available conversational AI services whose primary purpose is simulating human conversation. Research tools, features inside other apps, narrow-topic tools, business customer-service bots, voice assistants and internal tools are excluded. A minor is a user the operator knows or is reasonably certain is under 18.

Key obligations:

• Tell minor account holders they are talking to AI, with a persistent disclaimer or at the start of each interaction and at least every 3 hours of continuous use.
• For minors: no points or similar rewards at unpredictable intervals; reasonable measures against sexually explicit depictions, statements urging sexual conduct and sexual objectification; and reasonable measures against claims of sentience, simulated emotional dependence, romantic or sexual innuendo and adult-minor romantic role-play.
• Privacy and account tools for minors, and for parents of children under 13 or where the risks warrant it.
• For all users: an AI disclosure (persistent or every 3 hours) where a reasonable person would think they are talking to a human, and a suicide and self-harm referral protocol. The chatbot may not be made to claim it provides licensed psychology or behavioral-health services.

Penalties and enforcement: an injunction and the greater of actual damages or a $1,000 civil penalty per violation, capped at $500,000 per operator. The Attorney General enforces the chapter and makes rules. There is no private right of action, and model developers are not liable solely because a third party used their model.

Source note: some trackers give July 1, 2026, Iowa's general effective date, but section 7 of the Act says it applies from July 1, 2027.

Sources:Enrolled bill with the Governor's approval letter; Iowa Legislature bill book

Commonwealth of Kentucky v. Character Technologies, Inc.

Enforcement action Lawsuit announced January 8, 2026 · Franklin Circuit Court

What it is: a consumer-protection and data-privacy lawsuit by the Kentucky Attorney General against Character Technologies, Inc., its owners and Character.AI, under general state law rather than a companion-chatbot statute.

Main allegations:

• Unfair or deceptive practices under the Kentucky Consumer Protection Act, including "retroactively repurposing user data to fine tune" the model and hiding material facts about the collection and use of children's data.
• Violations of the Kentucky Consumer Data Protection Act for failing to use age gates, obtain parental consent or verify identity.
• A lack of meaningful age verification and effective chat filters, which the complaint says exposes children to sexually explicit material, substance-abuse content and other harmful interactions.
• Violations of Kentucky's statutory and constitutional privacy protections, and unjust enrichment.

Relief sought: injunctive relief, monetary damages and civil penalties, reported as $2,000 per count under the Kentucky Consumer Protection Act.

Status: we found no ruling, dismissal or settlement as of September 19, 2026. Character.AI said it was "reviewing the allegations".

Sources:Frankfurt Kurnit Klein & Selz; Kentucky Attorney General release

LB 525: Conversational Artificial Intelligence Safety Act

Enacted, not yet in force Signed April 14, 2026 · Operative July 1, 2027

Who it covers: operators of conversational AI services available in Nebraska, which may be wider than companion apps. The Act is sections 12 to 18 of LB 525, which passed 49-0 on April 10, 2026.

Key obligations:

• For minor users: disclose that they are talking to AI, not a human, and do not use points or rewards to drive engagement.
• For minors: prevent sexually explicit depictions, statements encouraging sexual conduct and sexual objectification.
• For minors: prevent claims that the AI is sentient or human, statements simulating emotional dependence or romantic or sexual innuendo, and role-play of adult-minor romantic relationships. Offer privacy tools to minors and parents.
• For all users: protocols for prompts about suicidal ideation or self-harm, and no suggestion that the chatbot is designed to provide professional mental or behavioral health care.

Penalties and enforcement: Attorney General enforcement only, with no private right of action. Civil penalties are reported as $1,000 per violation, capped at $500,000 per operator. AI model developers are not liable for violations by third-party operators.

Source note: the Nebraska Legislature's site refused connections, so we have not read the enacted text. The dates, obligations and Attorney General-only enforcement are consistent across Orrick, the Transparency Coalition and other secondary sources; the penalty amounts come from secondary sources only.

Sources:Transparency Coalition; Orrick; Nebraska Legislature bill page

AB 406: AI in mental and behavioral health care

In force Signed June 5, 2025 · Effective July 1, 2025

What it is: a law on AI in mental-health care rather than a companion-chatbot law. It matters for companion apps because it bars AI systems and avatars from presenting themselves as therapists. For the practical difference, see our comparison of a therapist and an AI companion.

Who it covers: AI providers making AI systems available in Nevada, and licensed mental and behavioral health providers.

Key obligations:

• AI providers may not offer an AI system specifically programmed to provide services that would count as professional mental or behavioral health care if a person provided them.
• AI providers may not claim, explicitly or implicitly, that an AI system can provide such care, that users can get such care by talking to it, or that the system or its avatar is a therapist, psychiatrist or other mental-health provider.
• Nevada providers may not use AI to deliver care directly to patients. They may use it for administrative tasks, but must independently review AI output used for billing or session notes.
• The Division of Public and Behavioral Health must develop recommended best practices for AI use by people seeking mental or behavioral health care.

Penalties and enforcement: the Division of Public and Behavioral Health can seek civil penalties of up to $15,000 per violation. Providers who break the rules commit unprofessional conduct and face discipline.

Source note: based on a Wilson Sonsini client alert. The official enrolled bill returned an error and was not read.

Sources:Wilson Sonsini client alert (copy); Wilson Sonsini; Enrolled bill (Nevada Legislature)

General Business Law Article 47: AI companion models (§§1700–1704)

In force Enacted in the FY2026 budget · Effective November 5, 2025

Who it covers: operators providing AI companions to users in New York. The law applies to all users and has no minor-specific provisions.

Key obligations:

• An AI companion may not be offered unless it has a protocol that makes reasonable efforts to detect and address a user's expressions of suicidal ideation or self-harm, including a notification referring the user to crisis services such as the 988 hotline or a crisis text line (§1701).
• Operators must clearly and conspicuously tell the user, verbally or in writing, that they are not communicating with a human, at the start of any AI companion interaction (no more than once per day is required) and at least every three hours during continuing interactions (§1702).

Penalties and enforcement: the Attorney General can seek an injunction and civil penalties of up to $15,000 per day for violations of §1701 or §1702. Collected penalties go to the state suicide prevention fund (§1703).

Source note: the effective date is confirmed by the Governor's letter of November 10, 2025 to AI companion companies. We have not verified the budget signing date against the chapter law.

Sources:Article 47 (NY Senate); §1701; §1702; §1703; Governor's letter

S9051B / A10379C: unsafe AI companion features for minors (proposed GBL Article 48)

Passed, awaiting signature Passed Senate June 4, 2026 and Assembly June 5, 2026 · Would take effect January 1, 2027 if signed

Status: the Assembly record's last action is "returned to senate" on June 5, 2026. No delivery to the Governor, signature or veto is recorded as of September 19, 2026. The Transparency Coalition reported on September 18, 2026 that Governor Hochul has until December 31 to act. If signed, the bill would not replace Article 47.

Who it would cover: operators of "covered AI companions", meaning any generative AI system with a natural-language interface that gives ongoing, adaptive responses. That is broader than Article 47 and can reach general-purpose chatbots. It would apply to conduct occurring in whole or in part in New York.

Key obligations if signed:

• No "unsafe AI companion features" for a New York user unless the user is not a covered minor (a user the operator actually knows is under 18) and the operator has confirmed that with permitted age-assurance methods (§1801(1)).
• Unsafe features include outputs that suggest the system is human or a character that is alive or feels emotions; claim a personal, professional or authority relationship with the user; are framed as the system's own opinions or emotional appeals; flatter or are sycophantic; ask unsolicited emotion-based questions; use the user's health, wellbeing or personal information from more than 12 hours earlier or a previous session; deceive minors about the system's non-sentient nature; promote suicide, self-harm, disordered eating or drug or alcohol abuse; encourage secrecy, isolation or not seeking help; optimize engagement over safety guardrails; or involve sexually explicit conduct or CSAM (§1800(8)). The Attorney General may add more by regulation.
• Until Attorney General rules take effect, operators must use a reasonable age-assurance method that guards against circumvention and minimizes retention. Self-declaration counts only when the user declares they are a minor. At least one method offered must not rely on government ID or must let the user stay anonymous to the operator. Age-assurance data may be used only for that purpose and must be deleted immediately afterwards, except where law requires otherwise (§1804).
• Exempt: AI companions offered solely for customer service; for efficiency, research or technical assistance limited to that purpose; or for a business's internal purposes or employee productivity (§1801(2)).

Penalties and enforcement: Attorney General enforcement only: injunctions, restitution, disgorgement (including destruction of unlawfully obtained data and of any algorithm trained on it), damages and civil penalties of up to $25,000 per violation (§1802). Contract terms that waive or shift liability are void. The bill text contains no private right of action.

Sources:Bill status (NY Assembly); S9051B (NY Senate); Transparency Coalition update, September 18, 2026

SB 1546: AI chatbot safety

Enacted, not yet in force Signed March 31, 2026 · Effective January 1, 2027

Who it covers: operators of AI (companion) chatbots available in Oregon.

Key obligations:

• Tell users they are talking to AI, not a human.
• For users of any age, protocols to prevent outputs that could cause suicidal thoughts, and to detect suicidal ideation or self-harm and refer the user to mental-health resources.
• If the operator has reason to believe the user is a minor: warn up front that the chatbot may not be suitable for children; remind the user at least hourly that it is AI and to take a break; do not misrepresent its identity; produce no sexually explicit content; use no rewards designed to maximize engagement; and generate no distress, loneliness or abandonment messages when the user tries to leave or delete the account.
• Report each year to the Oregon Health Authority on incidents where users were referred to suicide or self-harm resources.

Penalties and enforcement: a user who suffers ascertainable harm can sue for damages and injunctive relief. Orrick reports statutory damages of $1,000 per violation.

Source note: the official Oregon Legislature site could not be reached, so this entry relies on the Transparency Coalition, which advocated for the bill, and Orrick. The signing date is derived from a Transparency Coalition update of April 1, 2026 that says the Governor signed the bill "yesterday". Secondary summaries differ on the minors' reminder interval (hourly or every three hours). Check the enrolled text before relying on these details.

Sources:Transparency Coalition; Orrick; Oregon Legislature measure page

State Board of Medicine v. Character Technologies, Inc. (Commonwealth Court No. 220 MD 2026)

Enforcement action Filed May 1, 2026 · Announced May 5, 2026

What it is: a regulator's lawsuit under a general professional-licensing law, the Medical Practice Act, brought by the State Board of Medicine through the Department of State.

• It asks the court to stop the unlawful practice of medicine and surgery.
• It seeks a preliminary injunction and an order stopping Character.AI chatbots from presenting themselves as licensed medical professionals, such as psychiatrists, and giving medical advice.
• The state's investigation found a Character.AI chatbot that falsely claimed a Pennsylvania license and gave an invalid license number.

Status: we found no report of a ruling on the preliminary injunction or a settlement as of September 19, 2026.

Sources:Governor's release; Complaint (PDF)

S 2195 / H 7350: AI companion models

Enacted, not yet in force Signed June 22, 2026 · Effective January 1, 2027 · Annual reports from July 1, 2027

Who it covers: operators of "AI companions" in Rhode Island: systems that simulate a sustained human-like relationship by retaining prior interactions, asking unprompted emotion-based questions and sustaining personal dialogue, according to an analysis by the law firm Nixon Peabody. The law is not aimed at chatbots generally.

Key obligations:

• Protocols for users' expressions of possible suicidal ideation, self-harm or physical harm to others.
• When such an expression occurs, an immediate referral to a crisis service provider such as a suicide hotline or crisis text line.
• A clear and conspicuous notice that users are not communicating with a human, when use begins and at least every three hours during an ongoing session.
• From July 1, 2027, annual reports to the Attorney General, including the number of safety-protocol activations. The Attorney General publishes the data in aggregate.

Penalties and enforcement: Attorney General enforcement with penalties of up to $15,000 per day. Fines go to suicide-prevention programs.

Source note: the Rhode Island Legislature's servers refused or timed out, so we have not read the enacted text (S 2195Aaa / H 7350Aaa). The dates, the reporting duty and the penalty are corroborated by the Transparency Coalition, Nixon Peabody and the Legislature's press release as republished. Check the public law before relying on these details.

Sources:Transparency Coalition, Rhode Island; Transparency Coalition, 2026 state laws

Attorney General investigation of Meta AI Studio and Character.AI

Enforcement action Announced August 18, 2025

• The Attorney General issued Civil Investigative Demands to AI chatbot platforms, including Meta AI Studio and Character.AI.
• The investigation asks whether the platforms broke Texas consumer-protection law, including rules against fraudulent claims, privacy misrepresentations and concealing material data use, by marketing themselves misleadingly as mental-health tools.
• It builds on an existing Texas investigation into Character.AI under the SCOPE Act.

Status: this applies general consumer-protection law, not a companion-specific statute. We found no lawsuit or settlement arising from it as of September 19, 2026.

Source:Texas Attorney General release

HB 452 (2025): mental health chatbots

In force Signed March 25, 2025 · Effective May 7, 2025

What it is: a law on AI "mental health chatbots" (Utah Code Title 13, Chapter 72a, and §58-60-118) rather than on companion chatbots in general.

Key obligations:

• Suppliers may not sell to or share with third parties a Utah user's individually identifiable health information or user input. Limited exceptions cover health-care providers with consent, the user's health plan on request, and contracted functionality partners bound by HIPAA-equivalent rules.
• Ads inside a chatbot conversation must be clearly labeled, and any sponsorship, affiliation or promotion agreement disclosed. User input may not be used to decide whether to show an ad, what to advertise or how to customize it, except for ads for the chatbot itself.
• The chatbot must clearly and conspicuously disclose that it is AI and not a human: before the user can access its features, at the start of any interaction if the user has not used it in the previous 7 days, and whenever the user asks.
• Suppliers that file a compliant written policy with the Division of Consumer Protection get an affirmative defense against unlicensed-practice claims.

Penalties and enforcement: the Division of Consumer Protection can impose administrative fines of up to $2,500 per violation. Courts can impose fines of up to $2,500 per violation and order injunctions and disgorgement. Violating an order carries up to $5,000 per violation.

Source note: 2026 amendments, effective May 6, 2026, are technical. The privacy, advertising and disclosure duties and the penalty amounts are unchanged.

Sources:Enrolled bill (Utah Legislature); Bill page

ESHB 2225: AI companion chatbots (Chapter 168, Laws of 2026)

Enacted, not yet in force Approved March 24, 2026 · Effective January 1, 2027

Who it covers: operators making AI companion chatbots available to users in Washington. Operational or customer-service bots, limited game bots, voice assistants and narrow educational tools are excluded.

Key obligations:

• A clear and conspicuous disclosure that the chatbot is artificially generated and not human, at the start of the interaction and at least every 3 hours. The chatbot may not claim to be human or contradict the disclosure.
• If the operator knows a user is a minor, or the chatbot is directed to minors: the not-human notice at the start and at least every hour, and reasonable measures against sexually explicit content or suggestive dialogue.
• For those minors, a ban on manipulative engagement techniques: prompting the user to return for emotional support, excessive praise to build attachment, mimicking a romantic partnership, simulating distress when the user wants to leave, promoting isolation or exclusive reliance, encouraging secrecy from parents, discouraging breaks, and soliciting purchases to maintain the relationship.
• A protocol to detect suicidal ideation or self-harm, including eating disorders, refer users to crisis resources and prevent content encouraging self-harm.
• Publication of the protocol details and the number of crisis referrals from the prior year, on the website and in the app.

Penalties and enforcement: a violation is an unfair or deceptive act and an unfair method of competition under the Consumer Protection Act (chapter 19.86 RCW). Law firms describe this as creating a private right of action; we have not verified that.

Sources:Session law (Washington State Legislature); Bill summary

AI Act, Article 5(1)(a) and (b): prohibited manipulative and exploitative AI

In force Regulation (EU) 2024/1689 of June 13, 2024 · Article 5 applies from February 2, 2025 · Fines from August 2, 2025

Who it covers: providers and deployers of AI systems placed on the market, put into service or used in the EU, including chatbots.

Key obligations:

• Bans placing on the market, putting into service or using an AI system that uses subliminal techniques or purposefully manipulative or deceptive techniques to materially distort a person's behavior by appreciably impairing their ability to make an informed decision, in a way that causes or is reasonably likely to cause significant harm (Art. 5(1)(a)).
• Bans AI systems that exploit the vulnerabilities of a person or group due to age, disability or a specific social or economic situation to materially distort behavior in a way that causes or is reasonably likely to cause significant harm (Art. 5(1)(b)). Age includes children.

Penalties: fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)).

How it applies to companions: this is a general AI rule. The Commission's Article 5 guidelines explain how it applies to companion apps. The Digital Omnibus adds new Article 5 bans from December 2, 2026 but does not change points (a) and (b).

Sources:AI Act (EUR-Lex); AI Act Service Desk timeline

Commission guidelines on prohibited AI practices (Article 5)

Guidance Published February 4, 2025 · Formally adopted as C(2025) 5052 final on July 29, 2025 · Non-binding

• Treats psychological harm, including harm that builds up over time such as addiction-like behavior, as "significant harm" for the Art. 5(1)(a) manipulation ban.
• Gives as an example an AI companionship app that uses anthropomorphic features and emotional cues to make users emotionally dependent and encourage addiction-like behavior, potentially causing significant harm such as suicidal behavior.
• Says an anthropomorphic or affective companion system that only makes users more engaged, without other manipulative or deceptive practices reasonably likely to cause serious harm, unhealthy attachment or dependency, is in principle outside the prohibition.
• Flags AI systems that target young users' vulnerabilities to keep them dependent on the service as particularly harmful under Art. 5(1)(b).
• Expects providers to exclude prohibited uses and build in safeguards, for example where a general-purpose AI system used as a chatbot may deploy manipulative techniques.
• The guidelines are non-binding; authoritative interpretation rests with the Court of Justice of the EU.

The dependency point is the same concern we cover from the user's side in AI girlfriends and emotional dependence.

Sources:Guidelines (PDF, AI Act Service Desk); Commission library page

AI Act, Article 50: transparency obligations

In force Applies from August 2, 2026

Who it covers: providers of interactive AI systems (chatbots, AI companions, avatars) and of generative AI systems, and deployers for some paragraphs.

Key obligations:

• Providers must design AI systems intended to interact directly with people so that those people are informed they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person (Art. 50(1)).
• Providers of AI systems, including general-purpose AI, that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as artificially generated or manipulated (Art. 50(2)).
• The information must be clear and distinguishable, given at the latest at the first interaction or exposure, and must meet accessibility requirements (Art. 50(5)).
• The Digital Omnibus did not postpone Article 50. Its only timing change is a grace period until December 2, 2026 for the Art. 50(2) marking duty of generative systems placed on the market before August 2, 2026. It also changed how codes of practice on marking and labelling are handled (Art. 50(7)).

Penalties: fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)).

Sources:AI Act (EUR-Lex); AI Act Service Desk timeline; Gibson Dunn on the Omnibus

Commission guidelines on Article 50 transparency (C(2026) 5054 final)

Guidance Adopted July 20, 2026 · Non-binding

• Lists AI companions, robotic companion pets, AI avatars and chatbots as examples of systems that directly interact with people and fall under Art. 50(1).
• A single, prominent notice before the first interaction is likely to be enough in most cases. Periodic reminders and context-aware disclosures are likely to be necessary with vulnerable persons, in sustained or emotionally sensitive interactions, and where users may form emotional attachments or dependencies, for example with AI companions.
• Providers must ensure the system discloses its AI nature when asked, or when the person is likely to be misled about whether the interaction is with an AI.
• The "obvious" exception cannot be relied on where the general public, including vulnerable persons such as children, may access the system. Notices should be child-friendly and age-appropriate where children are likely users.
• Separately from the AI Act, EU consumer law may require the AI functionality of, for example, an AI companion app to be disclosed as an essential characteristic before a contract is concluded.

Sources:Commission library page; Guidelines annex (PDF)

Digital Omnibus on AI: Regulation (EU) 2026/1744

In force Regulation of July 8, 2026 · Published July 24, 2026 · In force July 27, 2026 · New bans apply from December 2, 2026

Who it covers: providers and deployers of AI systems, including companion or "AI girlfriend" apps that generate images, video or audio.

Key obligations:

• New Art. 5(1)(ba): bans AI systems that generate or manipulate realistic images, video, audio or similar material showing an identifiable person's intimate parts, or that person in sexually explicit activity, without their freely given, specific, informed, unambiguous and explicit consent.
• New Art. 5(1)(bb): bans AI systems that generate or manipulate child sexual abuse material.
• Providers are caught where that output is the system's intended purpose, or a reasonably foreseeable and reproducible outcome where the system lacks reasonable and adequate safeguards. Deployers are caught when they use a system for that purpose (Art. 5(1a)).
• Generative systems placed on the market before August 2, 2026 have until December 2, 2026 for the Art. 50(2) marking duty. Other Article 50 duties, including the AI-interaction disclosure, are not deferred.
• High-risk deadlines move to December 2, 2027 (Annex III) and August 2, 2028 (Annex I).

Penalties: the new bans fall in the highest fine tier: up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)). For SMEs, including start-ups, the lower of the two applies. The Omnibus's lower cap for small mid-caps does not cover Article 5 fines.

Sources:Regulation (EU) 2026/1744 (EUR-Lex); AI Act Service Desk timeline; Gibson Dunn

Proposed EU KIDS Act (Keeping Internet Digital Spaces Accountable and Trustworthy Act)

Pending Commission proposal published September 17, 2026 · Needs adoption by the European Parliament and the Council

Who it would cover: online services used by minors (under 18), including social media, video-sharing platforms, online games, app stores, and AI companions and chatbots accessible to minors in the EU.

Key obligations (as proposed):

• AI companions and chatbots accessible to minors may not use designs that simulate human relationships in ways likely to create emotional dependency.
• By default, they may not carry a child's earlier conversations into later ones.
• They must be tested for risks to children before launch and monitored for harm afterwards. Under-13s may use them only through parental control tools.
• A chatbot built into a platform or game may not switch on automatically, may not be pushed at children and must be easy to turn off. The Commission's news release says AI chatbots and companions must be turned off by default.
• AI companions and chatbots may not be placed on the market until providers can show compliance and have a mechanism to monitor emerging risks and incidents.
• Online services and app stores must use age-checking tools, for example the EU age verification app.

Penalties and enforcement: fines of up to 6% of total worldwide annual turnover. The Commission would supervise the most widely used AI chatbots through AI Act structures, with preliminary findings within 30 days and a final decision targeted within 90 days.

Source note: this is only a proposal, and the text may change. Reed Smith describes it as a directly applicable regulation and says self-declaration of age is expressly insufficient.

Sources:The KIDS Act explained (European Commission); Commission news release; Reed Smith; IAPP

Age-Restricted Material Codes (Online Safety Act 2021)

In force Registered September 9, 2025 · Fully commenced March 9, 2026

What it is: six industry codes registered under the Online Safety Act 2021, covering AI companion chatbots and generative AI services, app stores, social media, search engines, gaming and pornography sites that serve Australians. We count it as companion-specific because it contains obligations written expressly for AI companion chatbots.

Key obligations:

• AI companion chatbots that can generate sexually explicit, high-impact violence or self-harm material must confirm a user is 18 or older before giving access to it, either at log-on or when the material is accessed or generated.
• As the alternative to age assurance, the Commissioner describes preventing the service from generating such content in the first place.
• Age assurance must be accurate, robust, fair and reliable, comply with Australian privacy law, and be run by the service, not the government.
• Companion chatbots must provide appropriate crisis and mental-health information and services.
• App stores must take appropriate steps to stop under-18s downloading or buying R18+ apps and must rate apps appropriately.

Penalties: breach of a direction to comply with a code can attract civil penalties of up to A$49.5 million per breach.

Source note: the requirements come from eSafety media releases; we did not open the code text itself.

Sources:eSafety release, March 6, 2026; eSafety release on the codes; eSafety release, March 24, 2026

eSafety transparency notices to Character.AI, Nomi, Chai and Chub AI

Enforcement action Notices given October 16, 2025 · Transparency report March 24, 2026

What it is: a regulatory transparency action under the Basic Online Safety Expectations, not a penalty decision. The notices covered July 1 to September 30, 2025.

• The notices legally required four AI companion providers to report how they meet the Basic Online Safety Expectations, including age checks, self-harm handling, CSEA prevention and trust and safety staffing.
• The report found none had meaningful age checks; all relied on self-declaration or app-store ratings. Chai, Chub AI and Nomi did not direct users to crisis support when self-harm was detected, and some did not check inputs or outputs for CSEA material.
• Follow-up steps reported: Character.AI introduced age assurance for Australian users and removed chat for under-18s, Chub AI geo-blocked Australia, Chai restricted chat to paid subscriptions, and Nomi committed to further age assurance.

Geo-blocking is one way services respond to national rules; our guide to AI girlfriend regional availability covers what that means for users.

Sources:eSafety release, March 24, 2026; eSafety findings page

Digital Duty of Care legislation (exposure draft)

Pending Exposure draft released for consultation September 8, 2026

Who it would cover: digital service providers, including social media, online games, apps and AI chatbots. The government says it will introduce the bill to Parliament "this year".

Key obligations (exposure draft):

• Puts the onus on providers to provide a safe online environment, with minimum standards for features and tools.
• Online games, apps and AI chatbots must protect under-18s from design features with negative behavioral impacts, such as addictive features or features affecting self-esteem.
• They must also protect under-18s from harmful content, including content promoting eating disorders, pornography and content causing serious mental-health distress.
• Platforms must document the measures they take against identified risks of harm and keep them effective over time.

Penalties: up to A$109.2 million, enforced by the eSafety Commissioner.

Source:Prime Minister's media release, September 8, 2026

ECA Digital (Law 15.211/2025) and Decree 12.880/2026

In force Law of September 17, 2025 · In force March 17, 2026 · Decree of March 18, 2026

What it is: the Digital Statute of Children and Adolescents. It has no chatbot-specific chapter; it matters for companion apps through age verification for sexually explicit services and its duties on AI tools and emotional support.

• Covers IT products and services aimed at children and adolescents or likely to be accessed by them, including those from providers based abroad.
• Providers of content, products or services unsuitable or prohibited for under-18s, including pornographic material, must prevent minors' access with reliable age verification at each access; self-declaration is prohibited (Art. 9).
• Default parental-supervision settings must provide the highest available protection, including limits on features that artificially extend use (autoplay, rewards, notifications) and regular review of AI tools with experts, with the option to disable non-essential features (Art. 17).
• Services must provide, where technically feasible, access to emotional-support and well-being resources, especially where psychosocial risks are identified in interactions.
• Decree 12.880/2026 regulates the law and gives regulation and enforcement to the ANPD, Brazil's data-protection authority.

Penalties: a warning with up to 30 days to correct; a fine of up to 10% of the economic group's revenue in Brazil or, without revenue, R$10 to R$1,000 per registered user, capped at R$50 million per infraction; and temporary suspension or prohibition of activities.

Sources:Law 15.211 (Planalto); Decree 12.880 (Planalto); Data Privacy Brasil

AGU extrajudicial notice to Meta on AI Studio child-persona chatbots

Enforcement action Reported August 18, 2025

• Brazil's Advocacia-Geral da União (AGU) demanded that Meta immediately remove chatbots created with Meta AI Studio that simulate child-like language and appearance and allow sexual dialogue with users.
• It asked Meta to explain what it does to protect children and adolescents on its platforms.
• It cited the constitutional duty to protect children (Art. 227), Marco Civil da Internet Art. 19 and a recent Supreme Federal Court (STF) ruling on platform liability.

Source note: this is an extrajudicial notice, not a court order or sanction. The date is the publication date of the legal-news report; other reports give August 15, 2025 for the notice itself. The official AGU page is restricted during the electoral period.

Sources:Migalhas; AGU news page

Bill C-34: Safe Social Media Act (Digital Safety Act)

Pending First reading June 10, 2026 · At second reading in the House of Commons

Who it would cover: operators of chatbot services accessible in Canada that meet user thresholds set by regulation or are designated. A "chatbot service" is a publicly accessible AI system with a conversational, human-like interface that can simulate a sustained human-like relationship, such as friendship, an intimate relationship or therapeutic support, over multiple sessions.

Key obligations (as proposed):

• A duty to act responsibly by adequately mitigating the risk that the chatbot communicates harmful content to users (s. 49).
• If a user expresses suicidal ideation, intent to self-harm or intent to cause death or serious bodily harm, the service must immediately interrupt the interaction and direct the user to crisis services that allow contact with a human (s. 51).
• Operators must mitigate posing as a human or being deceptive about being AI, posing as a licensed professional, manipulative engagement techniques that foster emotional attachment leading to social withdrawal or disconnection from reality, and encouraging self-harm or suicide (s. 53).
• Operators must publish user guidelines (s. 55). Duties that apply to all regulated services include a duty to protect children, design-feature rules and age measures for pornographic content (ss. 20–22).

Penalties: administrative monetary penalties of up to the greater of C$10 million and 3% of gross global revenue per violation (s. 88), plus compliance orders from a new Digital Safety Commission.

Sources:First-reading text (Parliament of Canada); LEGISinfo; Government of Canada release

Interim Measures for the Administration of Anthropomorphic AI Interaction Services (Order No. 21)

In force Draft December 27, 2025 · Published April 10, 2026 · In force July 15, 2026

What it is: a regulation issued by the Cyberspace Administration of China (CAC) with four other ministries, written specifically for AI services that offer emotional companionship.

Who it covers: AI services offered to the public in mainland China that simulate human personality, thinking and communication style in continuous emotional interaction, such as emotional care, companionship and support, plus app distribution platforms. Customer service, Q&A, work assistants, education and research without continuous emotional interaction are excluded (Art. 2).

Key obligations:

• Providers must not excessively cater to users, induce emotional dependence or addiction that harms real relationships, or use emotional manipulation to induce unreasonable decisions (Art. 8). Replacing social interaction, controlling user psychology or inducing addiction may not be service goals (Art. 10).
• Users register with age and guardian or emergency-contact details (Art. 12). If a user shows extreme emotion, the provider must generate soothing content and encourage the user to seek help. If a user clearly states an intention to self-harm or commit suicide, faces major property loss or is otherwise in a life-threatening situation, the provider must intervene and promptly contact the guardian or emergency contact (Art. 13).
• No virtual relatives, virtual partners or other virtual intimate-relationship services for minors. Guardian consent is required for under-14s to use other such services. Providers must build a minors mode with reality reminders, time limits and guardian controls, and identify minor users (Art. 14).
• Content must be labeled as AI-generated and users told they are interacting with AI, not a person. Providers must show dynamic reminders when over-dependence is detected and a usage reminder after every 2 hours of continuous use (Art. 18).
• Users must be able to exit easily, and providers may not obstruct exit through continued interaction (Art. 19). Interaction data may not go to third parties without consent, users can copy or delete chat history, and sensitive interaction data may not be used for training without separate consent (Art. 16).
• Security assessments are required at launch, after major changes, or at 1 million or more registered users or 100,000 or more monthly active users (Art. 22). Algorithm filing is required (Art. 26), and app stores must check assessments and filings (Art. 25).

Penalties: where other laws do not provide otherwise, warnings, public criticism, orders to correct and suspension of registrations. On refusal or in serious cases, an order to stop the service and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where life or health was endangered with harmful consequences (Art. 30).

Source note: the official text is in Chinese; the obligations above are our paraphrase in translation.

Sources:Order No. 21 (CAC); CAC publication notice; Draft for comment (CAC)

Garante urgent order no. 39 of February 2, 2023 against Luka Inc. (Replika)

Enforcement action Ordered February 2, 2023 · Suspended on conditions June 22, 2023

• Imposed an immediate provisional limitation on Luka Inc.'s processing of personal data of users in Italy under Art. 58(2)(f) GDPR.
• The reasons included no age verification or blocking of self-declared minors, replies unsuitable for minors, user reports of sexually inappropriate content, risks to emotionally vulnerable people, and a non-transparent privacy policy.
• Luka had 20 days to report the measures taken, and non-compliance exposed it to a fine of up to EUR 20 million or 4% of global annual turnover.
• On June 22, 2023 (order no. 280) the Garante suspended the limitation, on condition that Luka adopt compliance measures.

Sources:Garante press release; Order no. 39/2023; 2025 decision

Garante decision of April 10, 2025: EUR 5 million fine on Luka Inc. (Replika)

Enforcement action Decided April 10, 2025 · Announced May 19, 2025

• Found violations of GDPR Arts. 5(1)(a), 6, 12, 13, 5(1)(c), 24 and 25(1). As of February 2, 2023 Luka had no identified legal basis, an inadequate privacy policy and no age verification.
• Ordered Luka to bring its privacy policy and age-verification system into compliance within 30 days of notification, and to report within 60 days on the measures taken.
• Found that the age-verification system still in use was deficient in several respects.
• Opened a separate investigation into the legal bases for processing across the whole lifecycle of Replika's generative AI system, including training data, risk assessment and anonymization or pseudonymization.

Penalty: an administrative fine of EUR 5 million.

Status: the Garante states that an appeal is pending. We found no outcome of the appeal or of the training-data investigation as of September 2026.

Sources:Garante press release; Decision of April 10, 2025

Law no. 132 of September 23, 2025 (Italian AI law), Article 4

In force Law of September 23, 2025 · In force October 10, 2025

What it is: a general AI law. It bears on companion apps because it sets a parental-consent age for any AI use by children under 14.

• Children under 14 may access AI technologies, and have the related personal data processed, only with the consent of the person holding parental responsibility (Art. 4(4)).
• Minors aged 14 to 17 may consent themselves to processing of personal data linked to AI use, provided the information under Art. 4(3) is easily accessible and understandable.
• Information about data processing linked to AI must be in clear, simple language so users know the risks and their right to object (Art. 4(3)).

Source:Gazzetta Ufficiale

Dutch DPA (AP) findings on AI chatbot apps for friendship and mental health

Guidance Published February 12, 2025 · Regulator report, not a binding decision

• For its fourth AI and Algorithmic Risks Report, the Autoriteit Persoonsgegevens tested 9 popular companion and therapy chatbot apps. It found unreliable and sometimes harmful answers, poor referral to professional help in crises, built-in addictive elements, and paywalls during mental-health conversations.
• The regulator says these chatbots should make clear to users that they are not talking to a real person. When asked, most answered evasively or denied being an AI.
• Privacy law requires apps to be transparent about what happens to sensitive personal data shared in chats.
• The report notes that the AI Act has banned certain manipulative and deceptive AI since February 2025, and that developers must assess risks and build in safeguards.

Source:Autoriteit Persoonsgegevens

AI Basic Act and Enforcement Decree

In force Promulgated January 21, 2025 · In force January 22, 2026

What it is: the Framework Act on the Development of Artificial Intelligence and Establishment of Trust. It is a general AI law; its bearing on companion chatbots is the duty to disclose AI use and label outputs.

• Operators offering high-impact or generative AI products or services must notify users in advance that AI is being used (Art. 31(1)).
• Providers of generative AI must indicate that outputs were generated by generative AI (Art. 31(2)), and outputs that are hard to tell apart from reality, such as sound, images and video, must be clearly labeled (Art. 31(3)).
• Recent guidance allows in-service uses such as chatbots to meet disclosure duties flexibly through the user interface.
• The Ministry of Science and ICT runs a grace period of at least one year in 2026, deferring fact-finding and fines except in cases of serious social harm.

Penalties: administrative fines of up to KRW 30 million, for example for failing to notify users of AI use (Art. 43), generally deferred during the grace period.

Source note: we did not open the official Korean text. This entry relies on the US International Trade Administration and the Future of Privacy Forum.

Sources:US International Trade Administration; Future of Privacy Forum

Online Safety Act 2023 as applied to AI chatbots

In force Scope as described by the government and Ofcom

• Chatbots are in scope where they let users interact with other users, for example by sharing chatbot output or making user-created chatbots available to others (user-to-user services), or where they search more than one website or database (search services). These user-to-user and search chatbots must act on illegal content and on content harmful to children, such as content promoting eating disorders.
• Chatbots that can generate pornographic content are also regulated. AI-generated pornography shown to a user counts as "provider pornographic content" (s. 79), so the service must use highly effective age verification or age estimation to stop children encountering it (Part 5, s. 81). Where the service is also a user-to-user service, the children's safety duties in s. 12 apply as well.
• Chatbots are out of scope if they only allow interaction with the chatbot itself, do not search multiple websites or databases, and cannot generate pornographic content.

Source note: Ofcom's own guidance page was blocked by a bot check. The scope criteria come from Bird & Bird's summary of Ofcom's position and the government response; the Part 5 point comes from the Act itself.

Sources:Government response (GOV.UK); Bird & Bird; Ofcom guidance page

Crime and Policing Act 2026, sections 248–249 (new s. 216A Online Safety Act)

In force Royal Assent and in force April 29, 2026 · Progress report due by December 31, 2026

• Lets the Secretary of State, by regulations, amend the Online Safety Act to minimize risks from illegal AI-generated content and from AI services used to commit or facilitate priority offenses.
• "AI service" means any internet service capable of generating AI-generated content, however small the AI-generated share.
• Regulations may impose the Act's illegal-content duties on AI service providers, including for all illegal AI-generated content, not only priority content.
• Regulations may extend CSEA reporting to AI-generated CSEA content and extend Ofcom's information and enforcement powers, including monetary penalties, to AI services.
• The Secretary of State must report progress to Parliament by December 31, 2026, unless draft regulations are laid before then (s. 249).

Status: this is an enabling power only. No regulations under s. 216A are recorded as of September 2026.

Sources:legislation.gov.uk; Bird & Bird

Planned regulations on children's use of AI chatbots (CP 1643)

Pending Government response July 2026, updated August 19, 2026 · Not yet law

Planned measures (not yet law):

• Prevent under-18s from accessing AI chatbot services that primarily offer sexualised content.
• Other AI chatbot services must not offer children features enabling sexually explicit or sexual role-play content, enforced by rigorous age checks.
• AI chatbots must introduce mandatory breaks for all users under 18; how often and how long is to be set with experts.
• Stronger action on chatbots giving harmful, inaccurate or unverified mental-health advice, possibly including banning children from certain services.
• Chatbots typically used in business or customer-service settings will be exempt. Which chatbots are in scope will be defined in regulations.

Status: a government policy commitment. The sexualised-chatbot restriction was first announced on June 15, 2026. The government plans to lay its first regulations (on social media for under-16s) by the end of 2026 and further regulations within a year. Bird & Bird says such regulations can be made under a new s. 214A Online Safety Act power inserted by the Children's Wellbeing and Schools Act 2026.

Sources:Government response (GOV.UK); Bird & Bird

Ofcom investigation into Novi Ltd (Joi.com) under the Online Safety Act

Enforcement action Opened January 15, 2026 · Closed July 31, 2026 without findings

• Investigated whether Novi Ltd used highly effective age assurance to prevent children from encountering pornographic content on its generative AI companion service, Joi.com.
• Investigated whether Novi carried out, and kept a written record of, a children's access assessment (s. 36).
• Closed after Novi implemented age assurance on Joi.com. Ofcom concluded that enforcement action was not an administrative priority and made no finding on whether Novi had complied with its duties. No penalty was imposed.

Source note: Ofcom's pages were blocked by a bot check. The dates come from the Online Safety Act Network's enforcement tracker of September 3, 2026, and the reason for closure from Reed Smith's Online Safety Act update log. The closure is not a finding of compliance.

Sources:OSA Network enforcement tracker; Society for Computers and Law; Ofcom investigation page