12 states pass 'companion chatbot' laws; three now in force

Twelve states have now passed laws aimed at "companion chatbots," and three of them — New York, California and Hawaii — are already in force. The other nine, from Colorado through Washington, take effect in 2027.

The tally comes from a rundown in Tech Policy Press by three DLA Piper lawyers: Danny Tobey, Ashley Carr and Michael Atleson. Reading the statutes side by side, they find four requirements that keep recurring: disclose the AI, protect minors, detect users in crisis, and stop claiming to be a licensed professional.

"All 12 laws require providers to clearly and conspicuously disclose to users that they are communicating with an AI system rather than a human being," the authors write. Washington's law goes furthest, requiring providers to prevent chatbots from expressly representing themselves as human at all; most other states apply that only to conversations with minors.

The minor-protection drafting is where the language gets concrete. Except in New York and Rhode Island, providers must take "reasonable measures" to block sexually explicit content, avoid engagement-maximizing tactics like "offering points or rewards," and prevent "emotional manipulation and dependency" that discourages users from seeking adult help. Colorado and Georgia add an affirmative duty to use "commercially reasonable" methods for age estimation.

Crisis-detection duties are universal. "All 12 laws require operators to implement protocols that detect user expressions of suicidal ideation or self-harm and refer them to appropriate crisis or mental health resources." Oregon specifies "clinical best practices and expertise." Colorado, Georgia and Oregon also require escalation procedures for repeated indicators. Several laws separately bar bots from claiming to be mental health professionals; Colorado extends the prohibition to healthcare providers, dietitians and attorneys.

Colorado is the first to start putting operational meat on the bones. On August 11 the state's attorney general released proposed rules on what "technically feasible" and "reasonable measures" actually mean, emphasizing testing, monitoring, documentation and remediation. Because so many state statutes borrow the same drafting, whatever Colorado enforces first is likely to shape everyone else's compliance work.

"The only thing certain in this area is change, with more laws, cases, and other activity on the horizon," the authors close.