Updated 2 November 2026: checked against the chaptered text of each bill, which is now linked. We corrected the audit duty (every two years from 2029, with an exemption until 2032 for operators under $500 million in revenue), added the start date (1 July 2027 for the main duties), and corrected the descriptions of SB 1276 and AB 1856. Where the Governor's release and the statute differ, we now say so. We removed the claims that this is the "most comprehensive" framework and a "de facto" benchmark for other countries, and the statement that the law codifies a duty of care, which its text does not. The teenager is no longer named.

Correction (19 October 2026): An earlier version said that SB 867 extends companion-bot duties to talking toys (it imposes a moratorium on toys that include a companion chatbot) and that SB 1276 closed the gap for AI-generated child-abuse imagery (California had already criminalised such material in 2024 through AB 1831); the descriptions of SB 1276, of the teenager after whom the law is named and of the source of the "not human" disclosure duty have also been corrected.

On 10 September 2026 Governor Gavin Newsom signed SB 1119 (Chapter 190), which adds a new chapter to California's Business and Professions Code. The chapter calls itself "Adam's Law". It sets child-safety rules for operators of companion chatbots, meaning AI systems that give adaptive, human-like replies and can meet a user's social needs. The main duties start on 1 July 2027.

According to the Governor's release, the law is part of a package of child online-safety bills signed that day. It is named after a California teenager who has died. His parents sued OpenAI, and we found no report that the case has ended.

Who does Adam's Law apply to?

It applies to anyone who makes a companion chatbot available to a user in California. A child is anyone under 18. Colleges offering a bot only for education and employers offering one only for work are outside it. The definition dates from SB 243 of 2025 and excludes customer-service bots, simple voice assistants and bots limited to a video game.

Under Section 21811 an operator has two choices. It can work out a user's age under California's Digital Age Assurance Act, or it can give every user the child protections. Most of the other duties bind only operators that allow child users. An operator that bars children must still publish how it checks age.

What does SB 1119 require?

The law requires a documented risk process, a set of product rules for child users, and outside audits.

  • Risk assessment. Before releasing a new or substantially modified chatbot, the operator must assess and document risks to child users and take reasonable steps to reduce them (Section 21812(a)). Covered harms include severe psychological harm.
  • Crisis protocol. Operators must have a documented protocol with clear referral to a crisis service. If the operator determines there is a credible and imminent threat of self-harm, it must either notify a linked parent, unless that risks serious harm to the child, or give the child direct access to a crisis helpline (Section 21812(d)(1)).
  • Defaults only a parent can change. Persistent conversational memory and push notifications are off, with a one-hour limit per session and two hours a day (Section 21812(d)(3)). Some memory is allowed for 16 and 17-year-olds if guardrails apply.
  • Behaviour limits. Operators must take reasonable measures to stop the bot from, among other things, encouraging self-harm, expressing romantic interest in the child, claiming to be sentient or human, discouraging breaks, encouraging reliance for emotional support, or using disproportionate flattery (Section 21812(d)(5)).
  • AI notice. Children must be told, in suitable language and repeatedly during long interactions, that they are dealing with AI (Section 21812(d)(4)). The general "not human" notice from SB 243 stays in Section 22602.
  • Advertising and data. No cross-context behavioural advertising to children, no selling their personal information, and no dark patterns in safety controls (Section 21813).
  • Records. If a child user has died or seriously self-harmed, or a crisis notice was given, conversation records showing that risk must be kept for at least three years (Section 21812.5).

How do the independent audits work?

A first audit is due by 1 January 2029 (or before a chatbot's first public release, if later), with further audits every two years and before certain riskier modifications (Section 21814). The chapter defines the audit as one by an independent third-party auditor. The operator sends a summary to the Attorney General within 30 business days and posts a high-level summary online within 90 days. The Attorney General can obtain the full report for cause, and a report given to the Attorney General is confidential.

The audit duty does not reach every company at first. Before 1 January 2032, operators with under $500 million in gross revenue in the prior calendar year are exempt. SB 1119 contains two versions of Section 21814, depending on whether AB 1405 on AI auditors is chaptered and takes effect by 1 January 2027. AB 1405 was chaptered on 9 September 2026 (Chapter 178), so in our reading the second version should apply. It keeps the dates above but drops the first version's express rules that the auditor be external and that the lead auditor certify the results under penalty of perjury. AB 1405 sets its own independence standards and, from 1 January 2029, requires AI auditors to register.

Where the Governor's release and the text differ

The release describes "annual risk assessments" and notifications "should a child disable safety settings". We did not find either in the chaptered text. The statute ties the risk assessment to each new or substantially modified chatbot and makes the defaults changeable only by a parent. The text should be relied on. The release also calls this the first law in the country to require independent child-safety audits. That is the Governor's claim, and we have not tested it.

Who can enforce it?

Public prosecutors can seek up to $5,000 per affected child for each negligent violation and up to $15,000 for each intentional one. Only the Attorney General can seek an injunction on that route (Section 21816(a)). A child who suffers actual harm from a breach of certain product duties, or a parent on the child's behalf, can also sue. Financial harm must exceed $1,000 and emotional harm must amount to serious emotional distress.

What else was signed that day?

  • SB 867 bans making or selling toys that include a companion chatbot until 1 January 2031. A toy is a physical product for play by children under 16. People injured can sue under the existing chatbot liability rule.
  • SB 1276 extends the child sexual exploitation offence to knowingly downloading, streaming or accessing such material, and covers digitally altered or AI-generated matter. It also adds such digitally altered or AI-generated matter to the definition of sexual exploitation used for mandated reporting. It builds on AB 1831 of 2024.
  • AB 1856 amends the Digital Age Assurance Act, under which operating systems send apps a signal of the user's age bracket. It also bars requests for that signal unless a law requires them.

The release lists other bills in the package on social media features, pupil data and reporting of abuse material.

How does this compare with other rules?

The EU AI Act works differently. Regulation (EU) 2024/1689 bans AI that exploits vulnerabilities due to age to cause significant harm (Article 5(1)(b)) and requires people to be told they are interacting with AI (Article 50(1)). It has no chapter on companion bots or parent-only defaults. Our EU AI Act page has the wider picture.

Courts and regulators have also reached these products under older law. A US federal court let product liability claims against a chatbot company proceed in 2025, and Italy's data protection authority fined Replika's developer over legal basis and age verification. Eight US state attorneys general have also sued OpenAI on child-safety grounds.

What does it mean for Türkiye?

We know of no Turkish statute on companion chatbots, and California's law does not bind Turkish courts or regulators. Existing Turkish law would apply instead. Law No. 6698 governs the personal data a child shares with a bot, and health data falls under the stricter rules of Article 6. Consumer Law No. 6502 covers defective services (Article 13), and Article 49 of the Code of Obligations covers fault-based damage.

The open questions are how a child's consent works for such a service, and whether design choices made to build attachment affect fault. We know of no Turkish decision on either point.

What to watch next

The next dates are in the statute: 1 July 2027 for the main duties, 1 January 2028 for the Attorney General's complaints mechanism and the first interface test, and 1 January 2029 for the first audit. We found no court challenge to SB 1119 as of 2 November 2026, though our search was not exhaustive.

Burhan Doğuş Ayparlar's View

This section reflects my personal assessment as the founder of this site and an attorney at law (Türkiye).

In my view, the law's main contribution is that it turns transparency and accountability into specific design decisions and auditable duties. A product built to cultivate a user's emotional dependence is not making a legally neutral choice. Putting behaviour in a crisis and independent audit at the centre seems right to me: the law looks at the product's overall safety design rather than one sentence a bot produced.

For Türkiye, I expect the interpretation of existing law on children's data, consumer protection and liability to come before any dedicated statute. That is an expectation, not a fact, and I know of no Turkish court that has yet tested it.

Sources: chaptered texts of SB 1119, SB 867, SB 1276 and AB 1856 (10 September 2026), AB 1405 (9 September 2026), SB 243 and AB 1831, on California's Legislative Information site; Governor's release of 10 September 2026; Senator Padilla's release on the lawsuit; Regulation (EU) 2024/1689; Turkish laws on mevzuat.gov.tr. Read on 1 and 2 November 2026. General information, not legal advice. If you or someone you know is struggling with thoughts of self-harm or suicide, please contact your local emergency services or a crisis line.