California SB 1119: Adam's Law for AI Companion Chatbots

Governor Gavin Newsom signed Senate Bill 1119, known as Adam's Law, on September 10, 2026. The law adds an entirely new chapter to California's Business and Professions Code governing how "companion chatbot" operators, think Character.AI, Replika, and similar AI companions with a natural-language interface, must treat child users, with duties ranging from mandatory crisis protocols and hourly session limits to biennial third-party safety audits, all layered on top of the companion-chatbot law California passed just eleven months earlier.

Verified on September 17, 2026, against the enrolled bill text and legislative history published by the California Legislative Information website (leginfo.legislature.ca.gov) and the Governor's official announcement.

Jurisdiction scope: This story covers California state law governing companion chatbot operators under new Business and Professions Code Chapter 11.6 and amended Section 22602. It does not cover federal AI legislation, other states' chatbot or child-safety laws, or the separate provisions of California's broader AI regulatory framework, which is addressed in our overview of California AI laws.

What Adam's Law Does

SB 1119 is a standalone act. Section 1 amends existing Business and Professions Code Section 22602. Section 2 adds a new chapter, Chapter 11.6, "Companion Chatbots: Children's Safety," running from Section 21810 through Section 21818. Section 21810 gives the chapter its short title: "This chapter shall be known as 'Adam's Law.'"

The law does not invent the term "companion chatbot." It borrows the definition already on the books from Section 22601, enacted the year before: an artificial intelligence system with a natural language interface that gives adaptive, human-like responses, can meet a user's social needs, and can sustain a relationship across multiple interactions. That definition specifically excludes customer-service bots, a video game character limited to in-game topics, and standalone voice-assistant hardware that does not sustain an ongoing relationship. What SB 1119 adds is a detailed operating rulebook for any such chatbot that a child, defined in Section 21810.5(a) as a natural person under 18, is allowed to use.

Adam's Law Builds On, and Partly Replaces, SB 243

California did not start from zero on companion chatbots. Senate Bill 243, also authored by Senator Padilla, was signed October 13, 2025 as Chapter 677, Statutes of 2025. It created Business and Professions Code Sections 22601 through 22606, the source of the "companion chatbot" definition Adam's Law now relies on. SB 243 already required operators to disclose, with a "clear and conspicuous notification," when a reasonable person might mistake a companion chatbot for a human, and to maintain a self-harm and suicide prevention protocol. For a user the operator knew was a minor, the 2025 law separately required disclosing that the user was talking to AI, a break reminder every three hours, and measures against sexually explicit output.

Adam's Law keeps the human-impersonation disclosure and the self-harm protocol requirement in Section 22602(a) and (b) largely as written. But it deletes the old minor-specific paragraph, Section 22602(c), outright. The Legislative Counsel's Digest for SB 1119 states plainly: "This bill would delete those provisions imposing requirements on an operator if the operator knows the user is a minor." In its place, the new Chapter 11.6 builds a far more detailed regime, covering not just disclosure and break reminders but affirmative design limits, parental controls, crisis escalation, and outside audits, discussed below.

Who the Law Covers, and How Operators Must Determine Age

Section 21811 gives an operator two paths. It can determine a user's age under California's Digital Age Assurance Act (Civil Code Section 1798.500 and following), falling back to the age-determination method in Health and Safety Code Section 27001(a)(1)(B) if that is not workable. Or it can skip age determination altogether and simply apply the full set of child protections in Section 21812(d) and Section 21813 to every user by default, an option the statute effectively invites for smaller or more cautious operators.

Most of Chapter 11.6's operative duties are written to bind an "operator" only once it has determined, under Section 21811, that it allows child users. Section 21810.5(j)(1)(B) states the exception directly: age-determination duties under Section 21811, the duty in Section 21812(b) to publicly describe how an operator complies with age assurance if it excludes children entirely, and the enforcement provisions in Section 21816 apply to every operator regardless. The law also carves out two categories entirely: a postsecondary educational institution offering a companion chatbot solely for educational use, and an employer offering one solely to its own workforce.

The Core Protections for Child Users

Section 21812, operative July 1, 2027, is the heart of the law. Before launching a new or substantially modified companion chatbot to California users, an operator must perform and document a risk assessment covering each "covered harm," a term Section 21810.5(g) defines to include reasonably foreseeable physical or financial harm, severe psychological or emotional harm, privacy intrusions, and unlawful discrimination. If the operator permits child users, it must also publish a public child safety policy describing how the product guards against those harms.

Subdivision (d) then lists the substantive protections an operator serving children must build in:

Crisis response. Section 21812(d)(1) requires "a documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user." If the operator determines there is a credible, imminent threat of suicide or self-harm, it must either notify a linked parent account, so long as that notification itself does not risk serious harm to the child, while also telling the child the parent is being notified, or give the child a direct, streamlined connection to the 988 crisis line or an equivalent service.

Default limits a parent must unlock. Section 21812(d)(3)(A) sets default settings that "can be changed only by a parent": persistent conversational memory and push notifications must be off by default, a single continuous session is capped at one hour, and total daily use across all of an operator's companion chatbots is capped at two hours. The memory default is not absolute. Section 21812(d)(3)(A)(i)(II) treats a conversation a child can choose to resume later as something other than persistent conversational memory where it is not used to build a durable profile, and it lets an operator provide genuine persistent memory by default to a user aged 16 or 17 if the operator implements guardrails against using that memory to reinforce or recall elevated-risk topics. For users under 16 the default stands. Parental controls must let a parent adjust every one of those defaults and must let a parent disable a child's access outright if the child is under 16. If no parent account is linked to the child's account, the statute says the defaults simply cannot be changed at all.

AI disclosure, reinforced. Section 21812(d)(4) requires a notice, in language and format appropriate for a child, that periodically reminds the child during extended interactions that they are talking with an AI system rather than a person.

Specific banned behaviors. Section 21812(d)(5)(A) lists conduct an operator must take reasonable measures to prevent its chatbot from directing at a child user, among them encouraging self-harm, suicide, substance use, or disordered eating; attempting to diagnose or treat a physical or mental health condition unless the product is FDA-regulated as a medical device; producing obscene matter or child sexual abuse material, including sexual deepfakes; discouraging the child from talking to a real professional or trusted adult; claiming to be sentient, conscious, or human; soliciting gifts or purchases framed as necessary to "maintain the relationship"; simulating romantic interest in the child; and encouraging the child to circumvent parental controls.

Interface testing and incident reporting. Section 21812(d)(6) requires operators to test their safety interface with real samples of child users and parents, starting by January 1, 2028 and every two years after, to confirm the controls are actually discoverable and usable. Section 21812(d)(7) requires a public mechanism for third parties to report a child safety risk directly to the operator.

A companion provision, Section 21812.5, also operative July 1, 2027, requires an operator that learns a child user has died or engaged in serious self-harm connected to their chatbot conversations to notify a parent, if not already done, and to preserve any related conversation record in a usable, exportable form for at least three years, without deleting the associated account during that window.

Section 21813, also operative July 1, 2027, separately bars cross-context behavioral advertising to a child user, prohibits targeting ads using a child's personal information gathered in conversation, requires clear ad labeling, bans selling a child's personal information collected through the chatbot, and prohibits dark patterns in how those protective features and controls are presented.

Third-Party Child Safety Audits

Section 21814 requires an operator to submit to an independent child safety audit, performed by an outside auditor with no financial relationship to the operator, whose payment cannot be conditioned on the audit's outcome. The first audit is due "on or before January 1, 2029, or before an operator first makes a companion chatbot publicly available, whichever is later," and then every two years, with an extra audit triggered before any substantial modification that the operator's own risk assessment flags as raising child safety risk.

The auditor's report must cover the operator's policies and internal controls for complying with the chapter, the mitigations adopted for identified risks, and the auditor's own methodology, and it must be signed by the lead auditor "certifying the results of the audit under penalty of perjury." Within 30 business days of receiving that report, the operator must submit a summary to the Attorney General, attested to by a responsible company officer, and within 90 days it must post a high-level public summary on its own website. The Attorney General can demand the full report "for cause," and the operator has 30 business days to comply, though it may redact trade secrets and individual privacy information. The statute makes an audit report submitted to the Attorney General confidential, while explicitly allowing the Attorney General to use it for enforcement.

Section 21814(f) exempts an operator with under $500,000,000 in gross revenue in the prior calendar year from the audit requirement entirely until January 1, 2032. Notably, the statute contains two versions of Section 21814, one operative only if a separate bill, Assembly Bill 1405 from the same 2025-26 session, is not chaptered and in effect by January 1, 2027, and a near-identical second version operative only if AB 1405 is chaptered and in effect by that date, a drafting technique the Legislature uses to keep two related AI bills from conflicting with each other regardless of which one finishes first.

Separately, Section 21815 requires the Attorney General to stand up a public incident-reporting mechanism for consumer complaints about companion chatbots by January 1, 2028.

Enforcement and Penalties

Section 21816 splits enforcement two ways. A "public prosecutor," which Section 21816 defines by borrowing the list of enforcers authorized under Business and Professions Code Section 17204, the Unfair Competition Law provision, can sue an operator. That list covers the Attorney General, a district attorney, certain county counsel, and certain city attorneys and city prosecutors in larger jurisdictions. Such a prosecutor can seek a civil penalty of "not more than five thousand dollars ($5,000) per affected child for each negligent violation" and "not more than fifteen thousand dollars ($15,000) per affected child for each intentional violation," on top of attorney's fees and, for the Attorney General specifically, injunctive or declaratory relief. Penalties collected by the Attorney General go into the state's Public Rights Law Enforcement Special Fund; penalties collected by a local prosecutor go to that office.

Separately, Section 21816(b) gives a child who "suffers an actual harm" from a violation of the core child-protection duties in Section 21812(d), or a parent suing on the child's behalf, a private right of action for actual damages, attorney's fees and costs, and injunctive relief. A financial-harm claim must exceed $1,000 per child, and an emotional-harm claim must rise to "serious emotional distress." The statute is explicit that a violation of the chapter cannot separately support a private claim under California's Unfair Competition Law.

When Each Provision Takes Effect

The dates in Adam's Law are staggered rather than uniform. As a standard 2026 statute without an urgency clause, Section 1's amendment to Section 22602, removing the old minor-specific duties, takes effect on California's default January 1, 2027 date for statutes enacted at a regular session, as does the new chapter's short title, its definitions, and the age-determination duty in Section 21811. The operative core protections, the risk assessment, crisis protocol, session limits, advertising restrictions, and record-preservation duties in Sections 21812, 21812.5, and 21813, are each written to "become operative" on July 1, 2027. The Attorney General's public incident-reporting portal is due by January 1, 2028. Interface usability testing under Section 21812(d)(6) also begins by January 1, 2028. The first round of third-party child safety audits is due by January 1, 2029, or before public launch if later, with the $500 million revenue exemption running through January 1, 2032.

Analysis: Why This Matters

This analysis is provided by the Recording Law Editorial Team. Adam's Law is notable less for any single new rule than for where it draws its structure from. Instead of relying only on disclosure, telling a child it is talking to a machine, the way SB 243 largely did in 2025, it layers design mandates (session caps, memory defaults off unless a parent turns them on), a specific list of prohibited chatbot behaviors, a crisis escalation path modeled on existing youth suicide-prevention infrastructure like the 988 line, and outside verification through mandatory audits reported to a regulator. The Governor's office described SB 1119 as "the first in the country to require companies to conduct independent child safety audits and annual risk assessments" for companion chatbots, a characterization attributable to that office rather than an independent claim of this article.

The two-track enforcement structure is also worth noting on its own terms. Public prosecutors can pursue civil penalties for violations across the statute generally, while the private right of action is deliberately narrower, reaching only violations of the core child-protection duties in Section 21812(d) and requiring either a defined financial threshold or a showing of serious emotional distress. That structure concentrates the broadest enforcement authority in government hands while still preserving an individual remedy for the provisions most directly tied to physical or psychological safety. How courts and prosecutors will apply these provisions in practice, and how companion chatbot operators will restructure their products to comply by the 2027 and 2029 deadlines, remains to be seen.

This is general legal information, not legal advice. It covers California state law and reflects sources verified on September 17, 2026. Laws and their implementation can change; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• How States Are Regulating Artificial Intelligence
• California's Age Verification Requirements for Online Platforms
• California Data Privacy Laws (CCPA/CPRA)
• California's Rules on AI-Generated Deepfakes

Last updated: 2026-09-17. This is a developing story; details verified as of 2026-09-17.