California's companion chatbot law adds disclosure duties

The design

On 13 October 2025 California's governor signed SB 243, which applies to operators of a 'companion chatbot', defined in the enacted text as a system with adaptive, human-like responses and anthropomorphic features capable of sustaining a relationship across multiple interactions. Operators must give a clear and conspicuous notification that the chatbot is artificially generated whenever a reasonable person might otherwise believe they are talking to a human. For a user known to be a minor, the operator must repeat that disclosure and, at least once every three hours during continuing use, remind the user to take a break and that the chatbot is not a person. The statute also bars the chatbot from producing sexually explicit material for a minor user.

What the evidence says

The bill's own text, chaptered the same day as Chapter 677 of the 2025 Statutes, is the source for these duties, and it creates a narrower safety requirement too: operators must maintain protocols intended to prevent the chatbot from producing content that encourages self-harm, and must issue a notification referring a user who expresses suicidal ideation to crisis service providers. Starting 1 July 2027, operators must report annually to California's Office of Suicide Prevention on the number of such crisis notifications issued and the detection methods used, and the office must publish that data. No such report yet exists; the obligation is prospective. The statute also creates a private right of action, letting an injured user sue for the greater of actual damages or 1,000 dollars per violation, plus attorney's fees.

What it asks of people

The law asks operators for engineering and disclosure work: building detection for self-harm expressions, wiring in break reminders, and eventually filing public reports. It asks users for nothing except attention to notifications the law now requires. It does not limit how long a user, adult or minor, spends with a companion chatbot beyond the periodic reminder, and it does not restrict what emotional content a companion chatbot may otherwise generate for an adult.

Privacy and safeguards

The statute's safeguard is procedural rather than substantive: it requires a referral to crisis services, not a guarantee that a chatbot cannot produce harmful content, and it does not specify what counts as an adequate detection protocol. The annual reporting duty, once it takes effect in 2027, will be the first point at which any outside party can check whether operators are issuing the referrals the law requires. Until then, compliance is unverified by any public record.

• Does a companion app disclose, unprompted, that SB 243's break reminders and crisis referrals apply to it under California law?
• What would the 2027 safety report need to show for a reader to trust the self-harm detection protocol behind it?
• Does the private right of action give a user a realistic way to enforce these duties, or does it depend on proving a violation occurred?

The law provides names and dates for protections that were, until 2025, a matter of a company's own choice. What it does not yet provide is public evidence that any of the required protocols function as described.