California SB 1119 (2025–2026)

Law & policy information

Name
Adam’s Law — Companion chatbots: children’s safety

Jurisdiction
California, United States

Instrument type
State statute regulating companion-chatbot operators

Bill / legal citation
SB 1119 (2025–2026); adds Business and Professions Code §§ 21810–21818 and amends § 22602. Chapter 190, Statutes of 2026.

Legislative or adoption status
Signed and chaptered September 10, 2026 (Chapter 190).

Effective dates
General effective date: January 1, 2027 under the ordinary constitutional rule. Core safeguards: July 1, 2027. Audit deadlines and exemptions are phased; see the timeline below.

Last source verification
September 13, 2026 — chapter number and signing/filing record checked; substantive enrolled-text review remains dated September 10, 2026.

Overview

Adam’s Law (California SB 1119, 2025–2026) establishes child-safety duties for operators of companion chatbots offered to users in California. Governor Gavin Newsom announced its signing on September 10, 2026. The measure adds a dedicated child-safety chapter to the Business and Professions Code, combining risk assessments, protective settings, restrictions on manipulative interactions and data use, independent audits, and public and private enforcement.

The law is named after Adam Raine. Its lead authors are Senator Steve Padilla and Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan. The governor signed it as part of a wider package that also included SB 867 on chatbot-enabled toys; those companion measures are separate laws with their own scope.

The provisions described below are drawn from the September 8 enrolled text. At the September 10 source check, the governor’s announcement confirmed signing, while the Legislature’s website still showed the measure as enrolled and presented to the governor. The signing date is therefore established by the announcement; a chapter number is not yet supplied here.

Scope: who and what is covered

A child is a person under 18. The law incorporates the existing definition of a companion chatbot: an AI system with a natural-language interface, adaptive human-like responses and the capacity to meet social needs and sustain a relationship across interactions. The incorporated definition excludes bots used only for specified business, customer-service, productivity, research or technical-support functions; narrowly confined game characters; and qualifying stand-alone voice-assistant devices that do not sustain relationships or elicit emotional responses.

An operator is generally a person making a companion chatbot available to a user in California. Most of the new duties apply to operators that allow children after age has been determined. Age assurance, the public explanation required when children are excluded, and enforcement are exceptions to that limitation. The definition also excludes postsecondary institutions providing chatbots exclusively in educational settings and entities providing them exclusively to workplace personnel.

The risk framework covers reasonably foreseeable physical or financial harm; severe, reasonably foreseeable psychological or emotional harm to a reasonable child; highly offensive intrusions on legally protected privacy; and unlawful discrimination. These defined categories guide the assessment and mitigation requirements.

Age assurance and risk assessment

Section 21811 gives operators two routes: determine users’ ages through the specified California age-assurance framework, with a statutory fallback when that determination is unavailable, or apply the specified child-protection and data-use safeguards to all users. Under the second route, parental default settings cannot be changed unless the operator actually knows the user is not a child. An operator that excludes children must publish and maintain a high-level explanation of its age-assurance compliance.

Before releasing a new or substantially modified chatbot, a covered operator must document a comprehensive assessment of child-safety risks and measures reasonably mitigating identified risks. The assessment addresses evaluation results, methodology, consulted benchmarks and research, and relevant experts. Sole reliance on public benchmarks requires justification. Comparable chatbots can share an assessment, and an assessment prepared under another law can qualify if its scope and effect are substantially similar. Section 21812 ties this obligation to release or material modification; it should not be summarized as merely an annual checklist.

Operators admitting children must also maintain a public child-safety policy explaining harm prevention and response, age assurance, privacy and advertising restrictions, protective settings and crisis protocols.

Requirements for children’s interactions

Protective defaults and parental controls

The default settings disable push notifications, limit a continuous session to one hour and total daily chatting across the operator’s companion chatbots to two hours, and restrict persistent conversational memory. Parents must be able to adjust the defaults and disable access for children under 16. Without a linked parent account, the defaults cannot be changed. Operators must actively explain and promote parental controls.

Memory rules contain qualifications for users aged 16 or 17. Saved conversations a child elects to resume are not treated as persistent memory if they do not build durable profiles; default persistent memory requires effective safeguards against undermining child-safety protections. The general definition also excludes information needed for safety, identification, user preferences or device configuration.

Children must receive understandable notices that they are interacting with AI, reinforced during extended interactions, along with usage reminders and accessible safety controls. Operators must test safety-interface usability with representative children and parents by January 1, 2028 and every two years thereafter, and provide a public mechanism for reporting child-safety incidents directly to the operator.

Crisis response and harmful behavior

A documented crisis protocol must address the risk of generating content promoting suicide or self-harm and provide timely referral to crisis services. When an operator determines that a threat is credible and imminent, it must take at least one of the specified steps: notify a linked parent, subject to the risk of serious harm to the child and notice to the child, or provide streamlined access to 988 or an equivalent crisis service. The statute does not require parental notification in every concerning conversation.

Operators must take reasonable measures to prevent specified behavior, including:

• Encouraging self-harm, substance use, disordered eating, or physical or severe emotional harm to others.
• Sexual abuse material, obscene interactions or depictions, including sexual deepfakes; and attempts at health diagnosis or treatment outside the specified medical-device and HIPAA conditions.
• Simulated romantic interest, claims of consciousness or human identity, claims of a special relationship with the child, encouragement of emotional dependence, or disproportionate flattery.
• Discouraging breaks or disclosure of health and safety concerns to an appropriate adult or professional; soliciting purchases as necessary to maintain the relationship; or encouraging concealment of use or circumvention of parental controls.

These restrictions preserve access to age-appropriate information about abuse, neglect, bullying and unsafe circumstances. Section 21812.5 separately requires preservation of relevant self-harm conversation records for at least three years when specified notice or knowledge triggers occur, and restricts deletion of associated accounts during required preservation.

Privacy and advertising

Section 21813 prohibits selling children’s personal information gathered through the chatbot and limits its use or sharing to specified service, safety, security, legal-compliance and legal-defense purposes. It prohibits cross-context behavioral advertising and targeting a child in chat using personal information. Limited, age-appropriate contextual advertising remains possible using specified information, including age, nonprecise location, device information and interests in goods or services expressed during the session; that information cannot be used to profile the child. Advertisements must be clearly labeled.

The section also prohibits dark patterns in interfaces for the required safety features and controls. These privacy and advertising requirements become operative July 1, 2027.

Independent audits and public accountability

Section 21814 sets the initial independent child-safety audit deadline at January 1, 2029, or before the operator first makes a chatbot publicly available, whichever is later. Audits recur every two years, with an additional audit before a substantial modification whose risk assessment shows increased child-safety risk. Operators with less than $500 million in prior-year gross revenue are exempt from this section before January 1, 2032; that temporary exemption is specific to audits. Comparable chatbots may share an audit, and sufficiently similar audits under other laws may qualify.

Audits examine compliance policies, mitigations and testing, safety and privacy controls, material deviations, and internal accountability. Operators must give auditors reasonably necessary documentation and retain required documentation and unredacted reports for the chatbot’s deployment plus five years. A responsible officer must attest to the accuracy of the summary submitted to the Attorney General within 30 business days of receipt; a high-level public summary is due within 90 days. The Attorney General may obtain a report for cause, subject to specified redactions and confidentiality protections that do not prevent enforcement use.

Relationship to AB 1405

The enrolled text contains two alternative versions of section 21814, depending on whether AB 1405, the AI auditor-registration law, is chaptered and takes effect by January 1, 2027. AB 1405 was chaptered on September 9 as Chapter 178. The alternative tied to that enactment retains the audit schedule, revenue exemption and reporting duties, while AB 1405 supplies a broader framework for auditor registration, independence and reporting. Its prohibition on offering or conducting covered audits without registration begins January 1, 2029. The two alternative SB 1119 provisions should not be combined into one cumulative set of requirements.

Enforcement and remedies

Section 21816 authorizes specified public prosecutors to seek civil penalties of up to $5,000 per affected child for each negligent violation and $15,000 per affected child for each intentional violation. It expressly authorizes the Attorney General to seek injunctive or declaratory relief, and provides for attorney’s fees and other appropriate relief.

The private action is narrower: a child suffering actual harm caused by a violation of section 21812(d)(1)–(5), or a parent or guardian acting for that child, may seek actual damages, fees and costs, injunctive or declaratory relief, and other appropriate relief. Financial harm must exceed $1,000 per child; emotional harm must amount to serious emotional distress. The provision does not create a private suit for every breach of the chapter, and a chapter violation cannot itself form the basis of a private Unfair Competition Law action.

Other legal duties and remedies remain cumulative, and the chapter does not require conduct violating federal law. The Attorney General must establish a public chatbot-complaint mechanism by January 1, 2028.

Legislative history and implementation timeline

Date	Development or deadline
February 17, 2026	Introduced in the Senate.
May 19, 2026	Senate passage, 39–0, followed by Assembly consideration and amendments.
August 31, 2026	Assembly passage and Senate concurrence in Assembly amendments; concurrence vote 39–0.
September 8–9, 2026	Enrolled September 8; presented to the governor September 9 at 2 p.m.
September 10, 2026	Governor announces signing.
January 1, 2027	General effective date under the ordinary constitutional rule for this non-urgency enactment, distinct from the later dates assigned to particular provisions.
July 1, 2027	Sections 21812, 21812.5 and 21813 become operative: core safeguards, specified record preservation, and privacy/advertising duties.
January 1, 2028	Initial interface-usability testing and Attorney General complaint-mechanism deadlines.
January 1, 2029	Initial audit deadline, subject to the later-first-availability rule and temporary revenue exemption.
January 1, 2032	Temporary audit exemption for operators below $500 million in prior-year gross revenue ends.

Related coverage

• California AI law directory
• Children and companion chatbots across jurisdictions
• California AB 1405 — AI auditor registration
• California SB 867 — chatbot-enabled toys
• September 10, 2026: signing and wider child-safety package
• September 24, 2026: FPF compares U.S. chatbot legislation
• August 31, 2026: final legislative approval

References