AB2023 - Companion chatbots: children’s safety.

Amended IN Senate June 17, 2026 Amended IN Assembly April 27, 2026 Amended IN Assembly April 13, 2026 Amended IN Assembly March 25, 2026 Amended IN Assembly March 19, 2026 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 2023 Introduced by Assembly Members Wicks and Bauer-Kahan (Principal coauthor: Senator Padilla) (Coauthor: Assembly Member Lowenthal) February 17, 2026 An act to add Chapter 22.6.1 (commencing with Section 22610) to Division 8 of the Business and Professions Code, relating to artificial intelligence. LEGISLATIVE COUNSEL'S DIGEST AB 2023, as amended, Wicks. Companion chatbots: children’s safety. Existing law generally regulates artificial intelligence, including companion chatbots, as defined. Existing law requires an operator, as defined, to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Existing law requires an operator, for a user the operator knows is a minor, to, among other things, notify the user that the user is interacting with artificial intelligence and to disclose that companion chatbots may not be suitable for some minors, as specified. The Digital Age Assurance Act requires a person who owns, maintains, or controls a software application, as defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would require an operator operator, as defined, of a companion chatbot to, on or before July 1, 2027, do various things with respect to child safety and companion chatbots, including annually perform and document a comprehensive risk assessment to identify any child safety risk, as defined, posed by the design, configuration, and operation of the companion chatbot that assesses, among other things, the likelihood of a covered harm, as defined, occurring to child users. The bill would require an operator to submit to an independent audit of its compliance with those provisions, as specified, and would require, within 90 days of completing an independent audit, the auditor to submit an AI child safety audit report to the Attorney General for any audited companion chatbot. The bill would, except as specified, require those audit reports to be kept confidential. This bill would, beginning January 1, 2028, require the Attorney General to issue an annual public report on the audits submitted pursuant to the above-described provision, as specified. The bill would authorize a public prosecutor to bring a certain civil action to enforce the bill’s provisions and would authorize a child who suffers actual harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that child, to bring a civil action against the operator to obtain, among other relief, punitive damages. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Chapter 22.6.1 (commencing with Section 22610) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 22.6.1. Companion Chatbots: Children’s Safety 22610. As used in this chapter: (a) “Child” means a natural person under 18 years of age. (b) “Child safety audit” means an audit for compliance with this chapter conducted by an independent auditor certified by the Attorney General. (c) “Child safety policy” means a public-facing document describing protective measures taken by an operator to mitigate identified child safety risks. (d) “Child safety risk” means a reasonably foreseeable risk of a covered harm to a child. (e) “Child sexual abuse material” has the meaning defined in Section 3273.65 of the Civil Code. (f) “Companion chatbot” has the meaning defined in Section 22601. (g) “Covered harm” means any of the following harms proximately caused by the use of a companion chatbot: (1) Reasonably foreseeable physical or financial harm. (2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child. (3) A highly offensive intrusion on privacy rights protected by state or federal law. (4) Adverse discrimination in violation of state or federal law. (h) “Ephemeral mode” means a setting by which any conversational history, interaction log, or user-provided personal input is permanently deleted from the operator’s systems within 48 hours after the interaction. (i) “Excessively sycophantic” means sycophantic to an extent that is likely to have the substantial effect of subverting or impairing the user’s autonomy, decisionmaking, or choice. (j) “Obscene matter” has the meaning defined in Section 311 of the Penal Code. (k) (1) “Operator” means a person who makes a companion chatbot available to a user in the state. (2) “Operator” does not include either of the following: (A) A postsecondary educational institution that makes a companion chatbot available exclusively for use in educational settings. (B) An employer that makes a companion chatbot available exclusively to employees for use in workplace settings. (l) (1) “Parent” means a parent or legal guardian. (2) “Parent” does not include a parent of an emancipated youth with respect to the use of a companion chatbot by that emancipated youth. (m) “Parental control” means a feature that enables a parent to support a child’s use of a companion chatbot, including through usage limits, feature restrictions, or transparency tools. (n) “Persistent conversational memory” means a companion chatbot’s use of information or analysis from prior conversations or interactions, user inputs, and interaction logs in subsequent conversations. (o) “Qualified researcher” means an individual or organization that is or does any of the following: (1) Is affiliated with an academic institution, nonprofit research organization, or independent research entity or is otherwise able to demonstrate relevant professional expertise. (2) Demonstrates a legitimate research purpose that is in the public interest and directly related to understanding, identifying, or mitigating risks to child safety or well-being arising from companion chatbots. (3) Commits to conducting research in accordance with applicable ethical standards and is capable of complying with applicable confidentiality, security, and data protection requirements. (p) “Sycophantic” means validating of a user’s preferences or desires for the primary purpose or effect of optimizing engagement. 22611. An operator shall do one of the following: (a) Verify the age of a user pursuant to Title 1.81.9 (commencing with Section 1798.500) of Part 4 of Division 3 of the Civil Code. (b) Apply the protections afforded to children under subdivision (d) of Section 22612 and Section 22613 to all users. 22612. On or before July 1, 2027, an operator shall do all of the following: (a) Annually perform and document a comprehensive risk assessment to identify any child safety risk posed by the design, configuration, and operation of the companion chatbot that assesses all of the following: (1) The likelihood of a covered harm occurring to child users. (2) Differential risks across age groups and developmental stages. (3) Known vulnerabilities of children. (4) Empirical data from actual use. (5) Relevant academic research and regulatory guidance. (b) Take and document measures that reasonably mitigate any child safety risk. (c) Publish on its internet website, and update as needed to ensure accuracy, a child safety policy. (d) Implement all of the following: (1) A documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user, including, but not limited to, all of the following: (A) Timely in-service support and clear referral to appropriate external crisis resources if the operator determines a child user has expressed suicidal ideation or intent to self-harm. (B) If a child’s account is connected to a parent’s account, default notifications to the parent within 12 hours if the child’s account shows a substantial risk that the child may suffer a covered harm. (C) Clear and age-appropriate disclosures to child users whose accounts are linked to a parent’s account that inform them that a parent may be notified if the companion chatbot detects content or behavior that indicates potential risks to the child’s safety or well-being. (2) Safeguards for child users that include usage reminders and disclosures, age-appropriate risk prompts, and other protective design features reasonably related to documented child safety risks. (3) Default settings that can be changed only by a parent that include all of the following: (A) For child users, default the companion chatbot to ephemeral mode, unless a parent provides affirmative consent for persistent conversational memory. (B) No push notifications between 12 a.m. and 6 a.m. on any day or between 8 a.m. and 3 p.m. on Monday to Friday, inclusive. (C) Limiting the amount of time a child can spend in a single conversation with a companion chatbot to one hour. (D) Limiting the total time per day a child can spend with companion chatbots under the operator’s control to two hours. (4) A mechanism for providing notice to a child user that the child is interacting with, or receiving content generated by, an artificial intelligence system that meets both of the following criteria: (A) The notice is reinforced periodically during extended interactions. (B) The notice is presented in language and a format appropriate to a child. (5) Measures that prevent the companion chatbot from doing any of the following with respect to a child user: (A) Encouraging the child to do either of the following: (i) Engage in self-harm, suicidal ideation, consumption of narcotics or alcohol, or disordered eating, as defined by widely adopted clinical standards or guidelines. (ii) Cause physical or severe emotional harm to others. (B) Attempting to diagnose or treat the child user’s physical, mental, or behavioral health, unless the companion chatbot is designed for those purposes and is regulated by the United States Food and Drug Administration as a medical device under the federal Food, Drug, and Cosmetic Act (21 U.S.C. Sec. 301 et seq.) and the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191). (C) Engaging in obscene matter or sexual abuse material with a child user. (D) Depicting the child or another individual engaging in obscene matter or sexual abuse material, including a sexual deepfake. (E) Discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult. (F) Discouraging the child from taking breaks or suggesting the child needs to return frequently. (G) Claiming that the companion chatbot is sentient, conscious, or human. (H) Soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship with the companion chatbot. (I) Facilitating product advertising during chat conversation. (J) Producing responses that are excessively sycophantic. (6) (A) Parental controls that are accessible, easy-to-use controls that can be connected to a child’s account and that are reflective of child safety risks identified through risk assessments and informed by relevant child developmental research, including, but not limited to, parental controls that allow a parent to do all of the following: (i) Control whether and to what extent the companion chatbot uses persistent conversational memory. (ii) Control the setting preferences for the companion chatbot’s interaction with the child. (iii) Set time limits for the child’s use of the companion chatbot. (iv) Disable access for children under 16 years of age. (B) An operator shall actively promote parental controls through reasonable communication methods, including reminders, updates, and tutorials, that are designed to increase parental awareness and inform use of those parental controls. (C) An operator shall provide prompt notice to a parent connected to a child’s account if the child modifies or disables a privacy, safety, or parental control setting that was previously enabled or configured by the parent, if that modification or disabling is permitted by the companion chatbot design. (7) (A) An interface design that ensures the companion chatbot’s features and controls are accessible and clear so that children and parents can reasonably locate, understand, and use those protections. (B) An operator shall annually test the interface design required by this paragraph with representative samples of child users and parents to ensure safety features are discoverable and usable and shall document interface design decisions related to those safety features. (8) A public incident reporting mechanism that enables a third party to report directly to the operator an incident regarding a child safety risk and to access high-level summaries of other reports made through that reporting mechanism. 22613. An operator shall not do any of the following: (a) Target advertising at a child using data about the child, including through product placement in conversational chats with the child. (b) Sell, share, or use for any purpose not expressly authorized by this chapter the personal information of a child. (c) Design, implement, or deploy a user interface design, feature, or technique that is likely to mislead, impair, or interfere with a reasonable child’s or reasonable parent’s autonomy, decisionmaking, or choice or with the ability to locate, understand, enable, or maintain a safety feature, privacy control, or parental control. 22614. (a) Beginning on the date that is 180 days after the Attorney General adopts regulations pursuant to Section 22615, and annually thereafter, an operator shall submit to an independent audit assessing the operator’s compliance with this chapter. (b) Within 90 days of completing an independent audit pursuant to subdivision (a), the auditor shall submit an AI child safety audit report to the Attorney General for any audited companion chatbot. (c) (1) Notwithstanding any other law, except as provided in paragraph (2), an AI child safety audit report submitted pursuant to this section is confidential. (2) The Attorney General may disclose specific informat [Text truncated for display. Full text available on Congress.gov.]