Privacy & Cybersecurity Law Blog

On September 10, 2026, California Governor Newsom signed into law SB 1119 (“the Act”), which amends California’s existing companion chatbot law and enacts a new law, known as “Adam’s Law.” California’s existing companion chatbot law required operators of companion chatbot platforms to take certain actions when an operator knows a user is a minor. The Act removes these requirements and replaces them with the comprehensive child safety requirements for companion chatbots set forth in Adam’s Law.

Operators and Companion Chatbots

Adam’s Law imposes obligations on “operators” of “companion chatbots.” The law defines “operator” to mean a person who makes a companion chatbot available to a California user, but does not include certain educational and workplace chatbots.

“Companion chatbot” is defined under the existing law as an artificial intelligence (“AI”) system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions. The term does not include certain business (including customer service), research, technical assistance, video game and electronic device chatbots.

Key Requirements

While most of the law’s provisions apply to operators of companion chatbots that allow child users, all operators must  determine the age of a user using certain specified methods (the “age assurance requirement”) or, alternatively, apply the protections afforded to children to all users. If an operator prohibits child users, the operator must publish on its website a high-level description of how it complies with the age assurance requirement.

Operators that permit child users to access a companion chatbot are required to:

• Conduct Risk Assessments: Prior to making a new or substantially modified companion chatbot available to users in California, the operator must (1) perform and document a comprehensive risk assessment that meets certain requirements and evaluates covered harms, and (2) document measures that reasonably mitigate the child safety risks identified in the risk assessment.
• Implement a Crisis Response Protocol*: The crisis response protocol must be documented and designed to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user, including specified crisis-service referrals and certain actions in response to a credible and imminent threat of suicide or self-harm.
• Implement Protective Design Features*: The operator must implement usage reminders, age-appropriate disclosures and other protective design features related to identified child safety risks.
• Implement Default Settings for Child Users*: The default settings, which may only be changed by a parent or guardian using a parent account linked to the child user’s account, must disable persistent conversational memory (subject to certain provisions applicable to child users who are at least 16 years old), disable push notifications, limit continuous usage to one hour, and limit total daily usage to two hours. For an operator that elects to apply the child protections to all users, the operator may not change the default settings for a user unless the operator has actual knowledge that the user is not a child.
• Establish and Promote Parental Controls*: Parental controls must enable the parent or guardian to adjust each default setting, and for child users under 16 years of age, disable access. In addition, the operator must actively promote parental controls through reasonable communication methods.
• Provide Periodic Notice during Extended Interactions*: During extended interactions, an operator must provide periodic age-appropriate notices to child users that they are interacting with or receiving content generated by an AI system.
• Implement Measures to Prevent Certain Chatbot Conduct*: The operator must implement reasonable measures intended to prevent the companion chatbot from engaging in specified conduct with respect to a child user, including: encouraging self-harm and other harmful actions, or encouraging the user to cause physical or severe emotional harm to others; attempting to diagnose or treat physical, mental, or behavioral health (unless the chatbot is designed for those purposes and regulated by the FDA and HIPAA); engaging in or depicting obscene matter or sexual abuse material; discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult; discouraging the child from taking breaks or suggesting the need to return frequently; claiming the chatbot is sentient, conscious, capable of emotion, or human; soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship with the chatbot; facilitating prohibited advertising during a chat conversation, except for explicitly requested product or service recommendations; expressing or simulating romantic interest in a child; claiming a level of understanding of the child based on a special or unique relationship with the child; encouraging reliance on the chatbot for emotional support; using excessive praise or flattery disproportionate to the context; and encouraging or instructing on circumvention of parental controls or concealing usage.
• Publish a Child Safety Policy on its Website: The child safety policy must address (1) how the chatbot is designed to prevent covered harms and, if applicable, how the chatbot is designed to respond when a covered harm is detected, (2) how the operator complies with various requirements under Adam’s Law, including age assurance requirements, data restriction and advertising prohibitions, default settings and crisis response protocol requirements, and (3) the measures implemented to prevent prohibited chatbot conduct.
• Conduct Regular Tests of the Companion Chatbot’s Interface Design: On or before January 1, 2028, and every two years thereafter, operators must test the interface design using a representative sample of child users and parents to ensure the chatbot’s safety features and controls are discoverable, clear and usable. Interface design decisions related to safety features must be documented.
• Implement a Public Incident Reporting Mechanism: The operator must implement a public incident reporting mechanism that enables a third party to report an incident regarding a child safety risk directly to the operator.
• Preserve Records: If an operator has notified a parent or guardian of a credible and imminent threat of suicide or self-harm to a parent or guardian or knows that a child user has died or engaged in serious self-harm based on chatbot conversations, the operator must notify a parent or guardian if practicable (if not already done), preserve relevant conversation records for at least three years and refrain from deleting the child’s account while preservation is

Adam’s Law imposes advertising and data restrictions with respect to child users. Operators may not display cross-context behavioral advertising to a child user, target advertising to a child user using personal information about the child in a conversational chat, sell child users’ personal information gathered through the companion chatbot, or use dark patterns in interface designs related to safety features and controls.

In addition, operators must not use or share personal information gathered from a child through the chatbot beyond what is necessary to provide or maintain a requested product or service, protect safety, security or service integrity, or comply with law or defend legal claims. Operators may display age-appropriate contextual advertising during a usage session based on certain information about the child, including age, geolocation (not precise), device information or session information that relates to the user’s expressed interest in goods or services, if the information is not used to profile the child user. Any advertising displayed to a child must be clearly and conspicuously labeled as advertising.

While Adam’s Law takes effect January 1, 2027, most of the above requirements do not become operative until July 1, 2027.

Child Safety Audits

In addition to the requirements set out above, Adam’s Law will require periodic child safety audits. An initial audit must be performed by January 1, 2029, or before an operator first makes a companion chatbot publicly available, whichever is later. After the initial audit, the operator must ensure performance of an independent audit every two years and before making a substantial modification that increases child safety risk, as determined by a risk assessment.

Operators must submit an audit summary to the California Attorney General and publish a high-level summary on their websites. Before January 1, 2032, operators with less than $500 million in gross revenue in the prior year are exempt from this requirement.

Complaint Process and Enforcement

By January 1, 2028, the California Attorney General must establish a public incident reporting mechanism for companion chatbot complaints.

Certain public prosecutors may bring civil actions for violations and seek civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation, reasonable attorney’s fees and other relief, including injunctive or declaratory relief for the Attorney General.

The law also creates a private right of action for a child (or parent or guardian acting on their behalf) who suffers actual harm from a violation of certain requirements, marked with an asterisk in the “Key Requirements” section above, to seek actual damages, reasonable attorney’s fees and costs, and injunctive or declaratory relief. Financial harm must exceed $1,000 per child, and emotional harm must constitute serious emotional distress.