Short version: anyone using an AI companion in the US now has protections that weren't on the books in 2024. They say little about pricing or data. What they do cover is what an app has to disclose, and how it has to react when a chat heads somewhere dark.
A patchwork built in twelve months
New York got there first. Article 47 of its General Business Law, the AI Companion Models law, became effective on November 5, 2025. It reaches every operator with New York users, no matter where the company is headquartered.
California was next. Governor's signature on SB 243 came October 13, 2025, and it's been enforceable since January 1, 2026. Uniquely so far, it lets a person who was hurt sue the operator directly.
Then 2026 brought a wave. Trackers had counted well over a dozen new state statutes on companion or conversational AI by July 2026, a list that runs from Washington and Oregon down to Georgia and South Carolina. Most kick in somewhere between mid-2026 and mid-2027.
Congress has passed no federal statute yet. Washington's action has been pressure instead. In September 2025 the Federal Trade Commission demanded answers from seven companies, including Character.AI, Meta, OpenAI, Snap and xAI, on how they test and watch their chatbots for harm to kids and teens.
Start dates for the leading state laws, taken from each statute.
The four things they keep asking for
The statutes have different authors but keep circling four requirements.
- Own up to being software. New York wants a prominent notice as a session opens and again every three hours if you keep going. California's version applies any time an ordinary person could mistake the bot for a human.
- Have a plan for a crisis. Operators must make reasonable efforts to catch expressions of suicidal thinking or self-harm and send people to crisis resources. California adds that the plan has to be posted on the company's website.
- Give minors different treatment. In California, a user the operator knows is a minor gets a break reminder every three hours and no sexual content. Newer statutes in Washington, Nebraska and Idaho add limits on engagement bait aimed at under-18s: rewards for returning, guilt-tripping, insisting the character is alive.
- File reports. California operators must start sending yearly reports to the state's Office of Suicide Prevention on July 1, 2027. Oregon and Rhode Island also require reporting.
Where they split: enforcement
Companies watch this column most closely. For you it matters because it drives how seriously the rules get followed.
| State | Statute | Effective | Key detail |
|---|---|---|---|
| New York | GBL Article 47 | Nov 5, 2025 | AI notice every 3 hours; enforced only by the Attorney General |
| California | SB 243 | Jan 1, 2026 | Public crisis protocol; users may sue for $1,000 per violation or actual damages |
| South Carolina | H 3431 | Feb 5, 2026 | Duties around safety by design and minimal data collection |
| Hawaii | SB 3001 | Jul 14, 2026 | Disclosure, crisis protocol, safeguards for minors |
| Colorado | HB 1263 | Aug 12, 2026 | Parental tools; no sexual content or gamification for minors |
| Connecticut | 2026 act | Oct 1, 2026 | Crisis protocol, parental controls, warning labels |
| Washington | HB 2225 | Jan 1, 2027 | Manipulative engagement tactics banned; treated as a consumer-protection violation |
| Oregon | SB 1546 | Jan 1, 2027 | Private right of action, $1,000 statutory damages |
| Rhode Island | S 2195 | Jan 1, 2027 | Yearly reporting; fines up to $15,000 per day |
| Nebraska, Idaho | LB 525, SB 1297 | Jul 1, 2027 | Targets bots falsely claiming to be human or sentient |
This reflects the statutes as of September 2026. Other bills are pending, and an amendment can move a start date.
The official California legislature page for SB 243.
Signs of the laws in daily use
- A banner or first line saying you're chatting with an AI. Some apps repeat it in long sessions. That isn't a judgment about you. It's a legal floor that applies to all users.
- Your character dropping the act when a line sounds like self-harm. Software can't dependably tell a grim scene in a story from a sincere statement, and an operator that misses the sincere one is liable. Expect false alarms. When one interrupts a story, a brief out-of-character note usually gets things rolling again.
- Tighter age checks. Character.AI stopped open-ended chat for users under 18 in November 2025. Its checks now use behavioral signals, third-party verification and, failing those, ID. Other apps are following, especially where a state has minor-specific rules.
- Less insistence on being real. Nebraska's and Idaho's statutes name AI that falsely claims to be human or sentient. A character that keeps doing that is now a compliance headache, so stronger apps are training it out.
The rules that apply depend on where you live, not where the company is registered. A New Yorker using an app operated from Cyprus is still covered by New York's law.
What the laws leave alone
Your chat history. Companion statutes barely mention how long conversations are kept or whether they feed a model. Broader privacy law covers that: the CCPA in California, similar statutes in a growing number of states, GDPR in Europe. Our four privacy checks are still the best tool you have.
Billing. Subscription traps, credit pricing and refunds come under normal consumer-protection law. Details are in refunds and cancellations.
Adult choices. No statute restricts what consenting adults do with a companion. The content rules deal with minors.
The European route
Europe used privacy law instead of companion-specific rules. Italy's data protection authority fined Luka Inc., Replika's maker, €5 million in a decision announced in May 2025. Its findings: no valid legal basis for processing, a privacy policy lacking transparency, and no functioning age verification on a service billed as adults-only. That regulator's February 2023 order preceded Replika's sudden removal of erotic roleplay, covered in when your AI companion changes overnight.
What it adds up to
Mostly these laws protect people at their most vulnerable: minors, and anyone in crisis. If you're an adult using a companion for company or fun, the visible shifts are minor: a notice, now and then a reminder, a hotline card when a plot turns grim. The invisible shift is larger. Operators now shoulder legal risk for their characters' behavior, which tends to make careful apps more careful and makes sloppy ones stand out.