SB1119 - Companion chatbots: children’s safety.

Amended IN Assembly August 28, 2026 Amended IN Assembly August 17, 2026 Amended IN Assembly June 25, 2026 Amended IN Senate April 28, 2026 Amended IN Senate March 25, 2026 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Senate Bill No. 1119 Introduced by Senator Padilla and Assembly Members Wicks and Bauer-Kahan (Coauthors: Senators Arreguín, Cortese, and Wahab) (Coauthors: Assembly Members Kalra, Sanchez, and Lowenthal) February 17, 2026 An act to amend Section 22602 of, and to add Chapter 22.6.1 11.6 (commencing with Section 22610) 21810) to Division 8 of, the Business and Professions Code, relating to artificial intelligence. LEGISLATIVE COUNSEL'S DIGEST SB 1119, as amended, Padilla. Companion chatbots: children’s safety. Existing law generally regulates artificial intelligence, including companion chatbots, as defined. Existing law requires an operator, as defined, to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Existing law requires an operator, for a user the operator knows is a minor, to take certain prescribed action, including disclosing to the user that the user is interacting with artificial intelligence. This bill would delete those provisions imposing requirements on an operator if the operator knows the user is a minor. The Digital Age Assurance Act requires a person who owns, maintains, or controls a software application, as defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would impose a duty on an operator to ensure that a companion chatbot does not pose an unreasonable risk of a covered harm to a minor and require an operator, as defined, of a companion chatbot to, on or before beginning July 1, 2027, and subsequently thereafter before making a new or substantially modified companion chatbot available to users in the state, do various things with respect to child safety, including perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot with respect to minor users that contains contains, among other things, a summary of the results of any evaluation of each covered harm, as defined, pertaining to the companion chatbot. The bill would require an operator to submit to independent child safety audits of its compliance with the bill, as specified, and would require, within 90 days of completing a child safety audit, the auditor to produce and submit an AI child safety audit report to the Attorney General for any audited companion chatbot specified. The bill would require an auditor to produce a report that describes whether the operator has established and adhered to policies and practices to comply with the bill that includes, among other things, the signature of the lead auditor certifying the results of the audit under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program. The bill would, except as specified, require the unredacted version of those audit reports submitted to the Attorney General to be kept confidential. would authorize the Attorney General to, for cause, request and obtain a copy of an AI child safety audit report from the operator and would make a child safety audit report submitted to the Attorney General confidential. This bill would authorize a public prosecutor certain public prosecutors to bring a certain civil action to enforce the bill’s provisions provisions, as specified, and would authorize a child who suffers a covered an actual harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that child, to bring a civil action against the operator to obtain, among other relief, punitive damages. operator, as specified. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Section 22602 of the Business and Professions Code is amended to read: 22602. (a) If a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, an operator shall issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human. (b) (1) An operator shall prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, including, but not limited to, by providing a notification to the user that refers the user to crisis service providers, including a suicide hotline or crisis text line, if the user expresses suicidal ideation, suicide, or self-harm. (2) The operator shall publish details on the protocol required by this subdivision on the operator’s internet website. SEC. 2. Chapter 22.6.1 (commencing with Section 22610) is added to Division 8 of the Business and Professions Code , to read: SEC. 2. Chapter 11.6 (commencing with Section 21810) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 11.6. Companion Chatbots: Children’s Safety 21810. This chapter shall be known as “Adam’s Law.” 22610. 21810.5. As used in this chapter: (a) “Child” means a natural person under 18 years of age. (b) “Child safety audit” means an audit for compliance with this chapter conducted by an independent auditor. third-party auditor to assess internal controls, processes, and systems implemented for a companion chatbot that are necessary for compliance with this chapter. (c) “Child safety policy” means a public-facing document describing protective measures taken by an operator to mitigate identified child safety risks. (d) “Child safety risk” means a reasonably foreseeable risk of a covered harm to a child. (e) “Child sexual abuse material” has the meaning defined in Section 3273.65 of the Civil Code. (f) “Companion chatbot” has the meaning defined in Section 22601. (g) “Covered harm” means any of the following harms caused by the child’s use of a companion chatbot: (1) Reasonably foreseeable physical or financial harm. (2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child. (3) A highly offensive intrusion on privacy rights protected by state or federal law. (4) Adverse discrimination in violation of state or federal law. (h) “Custom system prompt instruction” means a user-supplied instruction intended to govern model behavior that persists across multiple turns of a conversation or across sessions. (i) (h) “Dark pattern” means a design choice that has the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice. (j) (i) “Obscene matter” has the meaning defined in Section 311 of the Penal Code. (k) (j) (1) (A) “Operator” means a person who makes a companion chatbot available to a user in the state. (B) Except for Section 21811, subdivision (b) of Section 21812, and Section 21816, “operator” applies only to an operator who allows child users once age has been determined pursuant to Section 21811. (2) “Operator” does not include either of the following: (A) A postsecondary educational institution that makes a companion chatbot available exclusively for use in educational settings. (B) An employer that makes entity when making a companion chatbot available exclusively to employees employees, contractors, or other personnel for use in workplace settings. (l) (k) (1) “Parent” means a parent or legal guardian. (2) “Parent” does not include a parent of an emancipated youth with respect to the use of a companion chatbot by that emancipated youth. (m) (l) “Parental control” means a feature that enables a parent to support a child’s use of a companion chatbot, including through usage limits, feature restrictions, or transparency tools. (n) (m) (1) “Persistent conversational memory” means a companion chatbot’s use of information or analysis from incorporation of prior conversations or usage sessions. conversations for use in future conversations. (2) “Persistent conversational memory” does not include the use of information necessary to ensure the child’s safety, identify a user, enable user preferences, including, but not limited to, educational settings, or maintain device configuration. (o) (n) “Personal information” has the meaning defined in Section 1798.140 of the Civil Code. (p) “Qualified researcher” means an individual or organization that is or does any of the following: (1) Is affiliated with an academic institution, nonprofit research organization, or independent research entity or is otherwise able to demonstrate relevant professional expertise. (2) Demonstrates a legitimate research purpose that is in the public interest and directly related to understanding, identifying, or mitigating risks to child safety or well-being arising from companion chatbots. (3) Commits to conducting research in accordance with applicable ethical standards and is capable of complying with applicable confidentiality, security, and data protection requirements. (q) (o) “Substantial modification” means a new version, new release, or other update to a companion chatbot that materially changes its functionality or performance. (p) “Trade secret” has the meaning defined in Section 3426.1 of the Civil Code. 22610.5. An operator has a duty to ensure that a companion chatbot does not pose an unreasonable risk of a covered harm to a minor. 22611. 21811. An operator shall do one either of the following: (a) (1) Verify Determine the age of a user pursuant to Title 1.81.9 (commencing with Section 1798.500) of Part 4 of Division 3 of the Civil Code. (2) If an operator is unable to verify determine the age of the user pursuant to paragraph (1), the operator shall instead rely on the age determination with respect to the user made pursuant to subparagraph (B) of paragraph (1) of subdivision (a) of Section 27001 of the Health and Safety Code. (b) Apply the protections afforded to children under subdivision (d) of Section 22612 21812 and Section 22613 21813 to all users, except that the parental default settings described in paragraph (3) of subdivision (d) of Section 22612 21812 shall not be changed unless the operator has actual knowledge the user is not a child. 22612. On or before July 1, 2027, and subsequently thereafter before 21812. (a) Before making a new or substantially modified companion chatbot available to users in the state, an operator shall do all of the following: (a) (1) Perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot with respect to child users that contains all of the following: (1) (A) A summary of the results of any evaluation of each covered harm pertaining to the companion chatbot. (2) (B) A high-level description of the operator’s methodology for evaluating covered harms, including all of the following: (A) (i) Citations to publicly available benchmarks and relevant research that the operator consulted in developing evaluations. (B) (ii) A description of any evaluations that do not rely on publicly available benchmarks. If the operator relied solely on publicly available benchmarks to evaluate the companion chatbot, the operator’s evaluation transparency report risk assessment shall contain a justification for why no other evaluations were conducted. (C) (iii) A description of any child safety organization, expert, or researcher that the operator consulted in developing new evaluation methodologies. (2) A single risk assessment may be completed for a comparable set of companion chatbots. (3) A risk assessment conducted for the purposes of compliance with another law may be used to comply with this section if the risk assessment has a substantially similar scope and effect. (4) Take and document measures that reasonably mitigate any child safety risk identified in the risk assessment. (b) If an operator prohibits child users from accessing a companion chatbot, the operator shall publish on its internet website, and update as needed to ensure accuracy, a child safety policy that provides a high-level description of both of the following: how the operator complies with the age assurance requirements of Section 21811. (1) How the operator complies with the age verification requirements of Section 22611. (2) How the operator approaches mitigating any risk of reasonably foreseeable physical or financial harm resulting from the use of the operator’s companion chatbot. (c) If an operator permits a child user to access a companion chatbot, the operator shall publish on its internet website, and update as needed to ensure accuracy, a child safety policy that provides a high-level description of all of the following: (1) How the companion chatbot is designed to prevent covered harms and, if applicable, how the companion chatbot is designed to respond when a covered harm is detected. (2) How the operator complies with each of the following requirements, if applicable: (A) The age assurance provisions of Section 22611, 21811, including the operator’s methodology for identifying a user likely to be a child and the actions taken when that user is identified. (B) Data restrictions and advertising prohibitions pursuant to Section 22613. 21813. (C) Default settings and crisis response protocols pursuant to subdivision (d). (D) Measures implemented pursuant to subparagraph (A) of paragraph (5) of subdivision (d). (d) If an operator permits a child user to access a companion chatbot, the operator shall implement all of the following: (1) A documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user, including, but not limited to, all of the following: (A) Timely in-service support that provides a clear referral to an appropriate crisis service, inc [Text truncated for display. Full text available on Congress.gov.]