SB1119 - Companion chatbots: children’s safety.

Senate Bill No. 1119 CHAPTER 190 An act to amend Section 22602 of, and to add Chapter 11.6 (commencing with Section 21810) to Division 8 of, the Business and Professions Code, relating to artificial intelligence. [ Approved by Governor September 10, 2026. Filed with Secretary of State September 10, 2026. ] LEGISLATIVE COUNSEL'S DIGEST SB 1119, Padilla. Companion chatbots: children’s safety. Existing law generally regulates artificial intelligence, including companion chatbots, as defined. Existing law requires an operator, as defined, to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Existing law requires an operator, for a user the operator knows is a minor, to take certain prescribed action, including disclosing to the user that the user is interacting with artificial intelligence. This bill would delete those provisions imposing requirements on an operator if the operator knows the user is a minor. The Digital Age Assurance Act requires a person who owns, maintains, or controls a software application, as defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would require an operator, as defined, of a companion chatbot to, beginning July 1, 2027, before making a new or substantially modified companion chatbot available to users in the state, do various things with respect to child safety, including perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot with respect to minor users that contains, among other things, a summary of the results of any evaluation of each covered harm, as defined, pertaining to the companion chatbot. The bill would require an operator to submit to independent child safety audits of its compliance with the bill, as specified. The bill would require an auditor to produce a report that describes whether the operator has established and adhered to policies and practices to comply with the bill that includes, among other things, the signature of the lead auditor certifying the results of the audit under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program. The bill would authorize the Attorney General to, for cause, request and obtain a copy of an AI child safety audit report from the operator and would make a child safety audit report submitted to the Attorney General confidential. This bill would authorize certain public prosecutors to bring a civil action to enforce the bill’s provisions, as specified, and would authorize a child who suffers an actual harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that child, to bring a civil action against the operator, as specified. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Section 22602 of the Business and Professions Code is amended to read: 22602. (a) If a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, an operator shall issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. (b) (1) An operator shall prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, including, but not limited to, by providing a notification to the user that refers the user to crisis service providers, including a suicide hotline or crisis text line, if the user expresses suicidal ideation, suicide, or self-harm. (2) The operator shall publish details on the protocol required by this subdivision on the operator’s internet website. SEC. 2. Chapter 11.6 (commencing with Section 21810) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 11.6. Companion Chatbots: Children’s Safety 21810. This chapter shall be known as “Adam’s Law.” 21810.5. As used in this chapter: (a) “Child” means a natural person under 18 years of age. (b) “Child safety audit” means an audit conducted by an independent third-party auditor to assess internal controls, processes, and systems implemented for a companion chatbot that are necessary for compliance with this chapter. (c) “Child safety policy” means a public-facing document describing protective measures taken by an operator to mitigate identified child safety risks. (d) “Child safety risk” means a reasonably foreseeable risk of a covered harm to a child. (e) “Child sexual abuse material” has the meaning defined in Section 3273.65 of the Civil Code. (f) “Companion chatbot” has the meaning defined in Section 22601. (g) “Covered harm” means any of the following harms caused by the child’s use of a companion chatbot: (1) Reasonably foreseeable physical or financial harm. (2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child. (3) A highly offensive intrusion on privacy rights protected by state or federal law. (4) Adverse discrimination in violation of state or federal law. (h) “Dark pattern” means a design choice that has the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice. (i) “Obscene matter” has the meaning defined in Section 311 of the Penal Code. (j) (1) (A) “Operator” means a person who makes a companion chatbot available to a user in the state. (B) Except for Section 21811, subdivision (b) of Section 21812, and Section 21816, “operator” applies only to an operator who allows child users once age has been determined pursuant to Section 21811. (2) “Operator” does not include either of the following: (A) A postsecondary educational institution that makes a companion chatbot available exclusively for use in educational settings. (B) An entity when making a companion chatbot available exclusively to employees, contractors, or other personnel for use in workplace settings. (k) (1) “Parent” means a parent or legal guardian. (2) “Parent” does not include a parent of an emancipated youth with respect to the use of a companion chatbot by that emancipated youth. (l) “Parental control” means a feature that enables a parent to support a child’s use of a companion chatbot, including through usage limits, feature restrictions, or transparency tools. (m) (1) “Persistent conversational memory” means a companion chatbot’s incorporation of prior conversations for use in future conversations. (2) “Persistent conversational memory” does not include the use of information necessary to ensure the child’s safety, identify a user, enable user preferences, including, but not limited to, educational settings, or maintain device configuration. (n) “Personal information” has the meaning defined in Section 1798.140 of the Civil Code. (o) “Substantial modification” means a new version, new release, or other update to a companion chatbot that materially changes its functionality or performance. (p) “Trade secret” has the meaning defined in Section 3426.1 of the Civil Code. 21811. An operator shall do either of the following: (a) (1) Determine the age of a user pursuant to Title 1.81.9 (commencing with Section 1798.500) of Part 4 of Division 3 of the Civil Code. (2) If an operator is unable to determine the age of the user pursuant to paragraph (1), the operator shall instead rely on the age determination with respect to the user made pursuant to subparagraph (B) of paragraph (1) of subdivision (a) of Section 27001 of the Health and Safety Code. (b) Apply the protections afforded to children under subdivision (d) of Section 21812 and Section 21813 to all users, except that the parental default settings described in paragraph (3) of subdivision (d) of Section 21812 shall not be changed unless the operator has actual knowledge the user is not a child. 21812. (a) Before making a new or substantially modified companion chatbot available to users in the state, an operator shall do all of the following: (1) Perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot with respect to child users that contains all of the following: (A) A summary of the results of any evaluation of each covered harm pertaining to the companion chatbot. (B) A high-level description of the operator’s methodology for evaluating covered harms, including all of the following: (i) Citations to publicly available benchmarks and relevant research that the operator consulted in developing evaluations. (ii) A description of any evaluations that do not rely on publicly available benchmarks. If the operator relied solely on publicly available benchmarks to evaluate the companion chatbot, the operator’s risk assessment shall contain a justification for why no other evaluations were conducted. (iii) A description of any child safety organization, expert, or researcher that the operator consulted in developing new evaluation methodologies. (2) A single risk assessment may be completed for a comparable set of companion chatbots. (3) A risk assessment conducted for the purposes of compliance with another law may be used to comply with this section if the risk assessment has a substantially similar scope and effect. (4) Take and document measures that reasonably mitigate any child safety risk identified in the risk assessment. (b) If an operator prohibits child users from accessing a companion chatbot, the operator shall publish on its internet website, and update as needed to ensure accuracy, a high-level description of how the operator complies with the age assurance requirements of Section 21811. (c) If an operator permits a child user to access a companion chatbot, the operator shall publish on its internet website, and update as needed to ensure accuracy, a child safety policy that provides a high-level description of all of the following: (1) How the companion chatbot is designed to prevent covered harms and, if applicable, how the companion chatbot is designed to respond when a covered harm is detected. (2) How the operator complies with each of the following requirements, if applicable: (A) The age assurance provisions of Section 21811, including the operator’s methodology for identifying a user likely to be a child and the actions taken when that user is identified. (B) Data restrictions and advertising prohibitions pursuant to Section 21813. (C) Default settings and crisis response protocols pursuant to subdivision (d). (D) Measures implemented pursuant to subparagraph (A) of paragraph (5) of subdivision (d). (d) If an operator permits a child user to access a companion chatbot, the operator shall implement all of the following: (1) A documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user, including, but not limited to, all of the following: (A) Timely in-service support that provides a clear referral to an appropriate crisis service, including, but not limited to, a suicide hotline or a crisis text line. (B) If the operator determines there is a credible and imminent threat that a child user will engage in suicide or self-harm, the operator shall take at least one of the following actions: (i) If a child’s account is connected to a parent’s account, the operator shall provide a notification to the parent as soon as practicable if that notification does not risk a threat of serious harm to the child. The operator shall also provide notice to the child user that the parent is being notified. (ii) Deploy a mechanism by which the child user is provided streamlined access to connect directly with the 988 or equivalent crisis helpline or can be connected to a crisis helpline provider directly through the child user’s device. (C) Clear and age-appropriate disclosures to child users whose accounts are linked to a parent’s account that inform them that a parent may be notified if the companion chatbot detects content or behavior that indicates potential risks to the child’s safety or well-being. (2) Safeguards for child users that include usage reminders, disclosures presented in clear, age-appropriate language in a manner that is reasonably calculated to be noticed and understood by a child, and other protective design features reasonably related to identified child safety risks. (3) (A) Default settings that can be changed only by a parent that do all of the following: (i) (I) Disable persistent conversational memory. (II) With respect to a child user who is 16 years of age or older, both of the following apply: (ia) Storing past conversations that a child can elect to continue in the future is not considered persistent conversational memory if the stored conversations are not used to construct durable profiles of the child user. (ib) Persistent conversational memory shall not be provided by default to a child user unless the operator implements controls that provide effective guardrails against the risk of degradation of the operator’s child safety measures, including controls that prevent persistent conversational memory from being used to reinforce, recall, or extend prior interactions on topics the operator has identified as posing elevated risk to child users or research-backed technical controls, including limits on multiturn conversations. (ii) Disable push notifications. (iii) Limit the amount of time a child user can spend in a single continuous usage session with a companion chatbot to one hour. (iv) Limit the total time per day a child user can spend chatting with companion chatbots under the operator’s control to two hours. (B) (i) Parental controls shall enable the parent to adjust each default setting provided under subparagraph (A). (ii) Parental [Text truncated for display. Full text available on LegiScan.]