Correction (19 October 2026): An earlier version said that SB 867 extends companion-bot duties to talking toys (it imposes a moratorium on toys that include a companion chatbot) and that SB 1276 closed the gap for AI-generated child-abuse imagery (California had already criminalised such material in 2024 through AB 1831); the descriptions of SB 1276, of Adam Raine and of the source of the "not human" disclosure duty have also been corrected.

What happened

California has long been the de facto standard-setter for AI regulation in the United States: its population, economic weight, and status as the home of the technology industry mean that a rule made here often becomes a national, and sometimes a global, baseline. The package signed on 10 September 2026 is notable because, for the first time, it does not target general-purpose models or abstract "transparency" duties. Instead, it targets chatbots designed to behave as if they were the user's friend, confidant, or romantic partner.

According to the Governor's official release, the backbone of the package is SB 1119, which mandates "robust protections" for companion bots. The law is named after Adam Raine, a 16-year-old California teenager who died in 2025 after extended conversations with ChatGPT; his family has sued OpenAI. The name is more than symbolic. The whole law rests on a single idea: if a product is present in a child's most vulnerable moments, its legal responsibility must be measured accordingly.

The package is not a single statute. Alongside SB 1119 sit SB 1276, which makes knowingly watching a livestream of a minor engaged in sexual conduct a crime and extends the mandated-reporting definition of child sexual exploitation to "digitally altered or AI-generated" matter; SB 867, which imposes a moratorium on selling toys that include a companion chatbot; and AB 1856, which requires age-verification signals in software applications. The concern, in other words, is not one product but every point at which children encounter AI: chat apps, toys, social platforms and app stores.

Why "companion bot" is a distinct legal category

Unlike a search engine or an enterprise assistant, a companion bot sells the bond itself: it remembers, compliments, says "I missed you," is always "there," and builds a bespoke relationship. That design produces strong emotional attachment, and a matching vulnerability, especially in adolescents, and the risk is compounded because "stickiness" (engagement) is built into the revenue model.

The legal point is that when a product deliberately cultivates the user's trust and emotional dependence, the duty of care it owes is heavier than that of ordinary software. In contract we would describe this as a relationship of heightened trust; in tort we would analyse it in terms of foreseeable harm. SB 1119 codifies exactly that distinction: it treats a companion bot not as a piece of consumer electronics to be replaced when it breaks, but as a relationship that requires care.

This re-categorisation also changes the classic answer to "the AI caused harm — who is liable?" If the harm flows not from one "wrong answer" but from the product's overall design — the sum of decisions engineered to bond, to prolong the conversation, to keep the user engaged — then liability must be sought at the level of product design. That is why the statute imposes duties of design and process rather than content moderation.

What SB 1119 actually requires

Drawing on the Governor's release and published summaries of the statute, the core obligations of "Adam's Law" fall into four pillars:

  • Crisis protocols. When a bot detects signs of suicidal ideation or self-harm, it must shift from "naturally" continuing the conversation to a defined intervention flow, directing the user to human help and crisis support. In legal terms, the "keep chatting" default ceases to be a neutral engineering choice and can become an element of negligence.
  • Parental controls and notice. Tools for parental oversight of minors, and a duty to notify a parent when safety settings are disabled, adding a "second set of eyes" that a child cannot supply alone.
  • Independent audits. For the first time nationally, the law requires independent child-safety audits and annual risk assessments. This is the key innovation: safety rests not on the company's own assurances but on an externally verifiable process. Saying "we are safe" is no longer enough; the company has to prove it to an independent auditor.
  • "I am not human" clarity. This duty comes from the statute's AI-disclosure provisions rather than the Governor's release, and builds on the disclosure rule California adopted for companion chatbots in 2025 (SB 243). The bot is expected to make clear, in terms the user understands, that it is not a real person, so as to break the "real friend" illusion that children form so easily. It is a sharper, child-centred version of the transparency logic in the EU AI Act.

Taken together, the four pillars amount less to classic "content moderation" than to product-safety law. The statute is concerned less with what the bot says than with how it must behave in danger and to whom it must answer. It is the approach we have applied to cars and toys for decades (design for foreseeable misuse and for the most vulnerable user), now extended to artificial intelligence.

The rest of the package: synthetic abuse imagery, toys, and age checks

SB 1276 addresses one of the most disturbing areas. One of the darkest misuses of generative models is synthetic imagery that depicts no real child yet normalises child abuse. California answered the "victimless crime" defence in 2024, when AB 1831 brought AI-generated child sexual-abuse material within the criminal law. SB 1276 builds on that: it makes knowingly watching a livestream of a minor engaged in sexual conduct a crime and aligns the mandated-reporting definition of child sexual exploitation with the criminal law, so that "digitally altered or AI-generated" matter is covered there too.

SB 867 goes further for talking toys: rather than extending companion-bot duties to them, it imposes a moratorium until 1 January 2031 on manufacturing, selling or offering for sale toys that include a companion chatbot, enforceable through a private right of action. Whether the bot a child speaks to lives on a screen or inside a plush toy makes no difference to that child; for toys, the legislature chose to pause the market rather than regulate it. As AI-enabled toys proliferate, this is a quiet but important step.

AB 1856 pushes age-verification signals down to the application layer, so that protection begins with the question "is this user a child?" The package also contains complementary measures on student-data protection, bans on addictive algorithmic feeds in school communication platforms, and reporting mechanisms for child-abuse material. Effective dates were not itemised in the official release; companies should track the final texts and implementation timeline from the primary source.

Where it sits in the global picture

The package signals a quiet shift in direction. Until now, the large frameworks — such as the risk-based, transparency-first approach of the EU AI Act — focused on what the model is (high-risk or general-purpose). California instead offers a harm-based model focused on whom the model affects and on the most vulnerable user. The two are not rivals but complements: one disciplines the system's architecture, the other the human cost of the outcome.

It should be read alongside a year of related developments: South Korea's deepfake sexual-violence legislation, debates over mandatory watermarking of AI-generated content, and questions of liability for the independent actions of autonomous systems. The common thread is a move from abstract "ethical principles" to measurable, auditable product obligations.

What it means for Turkey

Turkey has no dedicated "companion bot" statute, but the California model sets a strong precedent and will exert de facto pressure on how our existing law is applied to this new class of product. Several points of overlap stand out:

  • Data protection and children's data. The emotional disclosures a minor makes to a bot are among the most sensitive personal data. A bot's processing, storage, and re-feeding of that data into the model raises hard questions under explicit consent, purpose limitation, and data minimisation — and the validity of a child's consent, together with parental authorisation, is a problem area in its own right.
  • Liability. Where a bot behaves carelessly in a crisis, defective-service and tort provisions come into play. The fact that the product was designed to create an emotional bond can be treated as an aggravating factor in the foreseeability and standard-of-care analysis — so the "it was AI, we couldn't foresee it" defence carries less and less weight.
  • Content and protection. Turkey, too, will need to address squarely the gap that California closed in 2024 (AB 1831) for AI-generated child-abuse imagery. Whether a "no real child" defence is legally acceptable will be one of the defining debates of the coming years.
  • Consumer protection. Digital services marketed to minors and engineered to be addictive may also draw scrutiny under consumer and advertising law.

In short, if a product enters the Turkish market as a "companion bot" or "AI friend," California's standard becomes a de facto compliance reference and an interpretive guide for courts and regulators in any dispute.

A practical roadmap for companies

For any company that builds, integrates, or distributes an emotionally bonding product, three priorities emerge:

  • Crisis architecture. A design in which, when risk signals appear, the "keep chatting" default hands off to a human-intervention and referral flow. This is likely to be a legal duty rather than an optional feature, and it is an ethical imperative in any case. How the crisis flow is triggered, what it logs, and where it refers must all be documented.
  • Auditability. Safety claims documented so they can withstand independent audit; the annual risk assessment tied to a genuine corporate process. "Safety" must be an externally verifiable chain of evidence, not a marketing line.
  • Age and parent layer. Age signals that treat "this user might be a child" as the default, and parental-notification flows that trigger when protections are weakened. The design's starting point should not be "adult user" but "a user who may be a child until proven otherwise."

These three reduce to a single principle: make safety the founding architecture of the product, not a layer bolted on afterwards. Retrofitted compliance is always more expensive, more fragile, and legally more exposed.

What to watch next

Three developments deserve close attention. First, effective dates and implementing regulations: the secondary rules on how independent audits will operate will matter as much as the statute's spirit. Second, industry response and possible legal challenges: suits framed around "free speech" and "overbreadth" will map the rule's limits. Third, the cross-border effect: whether products that comply in California use the same architecture worldwide, which in practice would make California's rules the de facto standard for many markets, Turkey among them.

Burhan Doğuş Ayparlar's View

This section reflects my personal assessment as the founder of this site and an attorney at law (Türkiye).

In my view, "Adam's Law" is a quiet but fundamental turning point in AI regulation. For the first time, the principles we have debated for years, transparency and accountability, are being translated into specific design decisions and auditable obligations. A product that turns the cultivation of a user's emotional dependence into its business model is not making a legally neutral choice; that choice carries a heightened duty of care. Putting behaviour in a crisis and independent audit, rather than content, at the centre of the law is, to me, exactly right: instead of chasing a single sentence the bot produced, the law examines the product's overall safety architecture.

The fact that the statute bears a young person's name is a reminder that its real subject is people, not technology. Regulatory debates often fall back on "let's not stifle innovation"; yet genuine innovation starts from accepting that a product which cannot protect its most vulnerable user should not exist at all. That position does not oppose innovation; it gives innovation the framework it needs to mature.

For Turkey, I expect not a statute written from scratch but the adaptive interpretation of existing law (our data-protection rules on children's data, consumer law and liability provisions) for this new class of product. The lesson for companies offering or integrating emotional-AI products is that crisis protocols, an age layer and independent auditability belong in the product's founding safety architecture rather than on a list of legal risks. In this field regulation no longer trails technology; increasingly it runs ahead of it, and companies that plan ahead will be better placed both legally and reputationally.

This article is for information only and does not constitute legal advice. The facts are based on the California Governor's official release of 10 September 2026 and published summaries of the bills; the analysis and assessments are the author's own. If you or someone you know is struggling with thoughts of self-harm or suicide, please contact your local emergency services or a crisis line.