Companion chatbot laws · what to count and keep · updated 9 October 2026

Companion chatbot laws: what each state asks you to count and keep

Four US states now have laws for companion chatbots, AI that keeps up a relationship with a user across sessions. New York's has applied since 5 November 2025 and California's SB 243 since 1 January 2026; Washington's HB 2225 and Oregon's SB 1546 apply from 1 January 2027. Each asks for an AI notice on a schedule and a crisis protocol. Three ask for a number every year; California's begins “Beginning July 1, 2027, an operator shall annually report to the office” (Cal. Bus. & Prof. Code § 22603(a)) (read 9 October 2026), and counts the crisis referral notifications of the year before. So the first report counts 2026: the referrals your protocol is making now.

What each state asks, and from when

State	Law	Applies	AI notice	Yearly number
New York	GBL Article 47	since 5 November 2025	at the start of an interaction (at most once a day), then at least every 3 hours	none
California	SB 243	since 1 January 2026	where users could be misled; for known minors, every 3 hours with a break reminder, until 31 December 2026	crisis referral notifications in the year before, to the Office of Suicide Prevention, from 1 July 2027 (what to count)
California	SB 1119, Adam's Law	mostly from 1 July 2027	replaces SB 243's rules for known minors from 1 January 2027	audit summaries to the Attorney General; the first audit by 1 January 2029
Washington	HB 2225	from 1 January 2027	at the start, then at least every 3 hours; for known minors, at least every hour	last year's crisis referral notifications, on your website and in your app
Oregon	SB 1546	from 1 January 2027	where users would think it is a person; for minors, a break reminder at least every 3 hours	referrals in the year before, on a public website by 31 December

What to count, starting now

The yearly numbers are counts your own systems can keep the moment your protocol shows a referral. Keep them by day or by month, beside the protocol version in force that day. The notice duties are shown best by the same kind of total:

crisis-service referral notifications your protocol showed (each time it referred someone to a crisis line)
sessions: continuing interactions, as your app counts them
sessions that began without the AI notice
sessions that ran past 3 hours without the AI notice being shown again
sessions of users you know are minors that ran past 1 hour without the AI notice being shown again
sessions of users you know are minors that ran past 3 hours without a break reminder

And keep the documents: each version of your crisis protocol with the date it took effect, where its details were published, and the notice's text with each release that changed it.

Does a law apply to your app?

That question is answered free elsewhere: AI Laws by State has an “Am I Affected?” checker, and the Future of Privacy Forum compares the California, Oregon and Washington laws side by side. These pages start after that: what to count and keep once one does. Whether one applies to you is for you and your counsel.

What these pages never ask for

The records these laws ask for are counts, dates and documents. Nothing here asks for, reads or keeps a conversation, a message or anything about a user, and nothing here detects or classifies anything: it counts what your own protocol already did.

Other states

Fenwick's list of 7 October 2026 names about a dozen more states with companion-chatbot laws dated from 1 January 2027 to 1 July 2027, among them Colorado, Rhode Island, Hawaii and Georgia. Each is added here once its statute has been read. For the disclosure laws that reach every chatbot, companion or not (the EU AI Act's Article 50, California's BOT Act, Utah), see AI disclosure.

A hosted record of your crisis-referral counts and notice cadence, with the Oregon and Washington public pages kept current for you, is not built

It would take your daily totals (never a conversation or anything about a user), keep them in a hash-chained log with each protocol version, and keep California's yearly draft and the Oregon and Washington pages current.

What exists today: these pages, and the counts and documents you keep yourself. okgate's hash-chained log records the tool calls AI agents make, not your app's events, so it cannot keep this record today.

I want that record