California SB 1119

Overview

SB 1119, known as “Adam’s Law,” is a California statute directed at companion chatbots and children’s safety. It amends existing Business and Professions Code Section 22602 and adds a new Chapter 11.6 (commencing with Section 21810) to Division 8. The law updates the existing disclosure and suicide/self-harm protocol framework for companion chatbots, while creating a new child-safety regime for operators that make companion chatbots available in the state. Its central structure is preventive: before a new or substantially modified companion chatbot is released, the operator must perform and document a comprehensive child-safety risk assessment, adopt mitigation measures, and publish or maintain certain public-facing policies. The chapter also establishes age-assurance, default-setting, advertising, privacy, audit, and enforcement rules. The statute takes effect on January 1, 2027, while the new chapter becomes operative on July 1, 2027.

The law combines product-safety style design obligations with privacy and consumer-protection controls. It requires crisis-response protocols, parental controls, limits on persistent conversational memory, time limits, restrictions on dark patterns, and a prohibition on several harmful chatbot behaviors directed toward child users. It also creates a child safety audit requirement with independent auditors, report retention rules, Attorney General access on cause, and confidentiality protections for submitted audit reports. Enforcement is available to public prosecutors under Civil Code section 17204 and to injured children or parents/guardians for specified violations that cause actual harm. The statute expressly states that its duties are cumulative and do not displace other laws, and that it should not be construed to require conduct that violates federal law.

Definitions

The chapter contains a detailed definitions section that anchors the compliance framework. “Child” means a natural person under 18 years of age. “Operator” means a person who makes a companion chatbot available to a user in the state, though the term is narrowed for some provisions and excludes postsecondary institutions using the chatbot exclusively in educational settings and entities using a chatbot exclusively for employees, contractors, or other personnel in workplace settings. The chapter defines “child safety audit,” “child safety policy,” “child safety risk,” “covered harm,” “dark pattern,” “parent,” “parental control,” “persistent conversational memory,” “personal information,” “substantial modification,” and incorporates existing statutory meanings for “companion chatbot,” “child sexual abuse material,” “obscene matter,” and “trade secret.”

Several definitions are especially important because they drive the substantive duties. A “covered harm” includes reasonably foreseeable physical or financial harm, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, highly offensive intrusions on privacy rights protected by state or federal law, and adverse discrimination in violation of state or federal law. “Persistent conversational memory” is defined to mean incorporation of prior conversations for future conversations, but not safety-related information, user identification, preferences such as educational settings, or device configuration. “Substantial modification” covers a new version, new release, or other update that materially changes functionality or performance. These definitions make the statute operationally specific and tie compliance to design, deployment, and iterative changes rather than only to a chatbot’s initial launch.

Governance and Institutional Framework

The statute distributes oversight across operators, parents, independent auditors, the Attorney General, and public prosecutors. Operators bear the primary duty to assess risks, implement safeguards, publish required policies, and maintain records. Independent third-party auditors provide external verification through child safety audits. The Attorney General receives summaries of audit reports, may request a full report for cause, and may use a submitted audit report for enforcement purposes even though the report is confidential. The law also creates a public incident reporting mechanism to be established by the Attorney General by January 1, 2028, allowing consumers to submit complaints relating to companion chatbots.

Parental involvement is built into the default-setting architecture. If a parent account is linked, the operator must make certain safety settings changeable only by a parent, and parental controls must support adjustment of those settings and the ability to disable access for a child under 16. The statute therefore treats parental oversight as part of the governance model rather than merely a notification feature. In addition, the law authorizes civil actions by specified public prosecutors and by children or parents/guardians who suffer actual harm from certain violations. This creates a multi-layer enforcement framework combining administrative oversight, private redress, and public enforcement. For official bill information and chapter status, see the California Legislative Information portal at SB 1119 bill text and the Governor’s signing announcement at CA.gov.

Key Focus Areas

The core policy focus is child safety in conversational AI environments. The law requires operators to assess and mitigate covered harms associated with a companion chatbot’s design, configuration, and operation. It also requires a crisis response protocol where there is a material risk that the chatbot will generate suicidal ideation, suicide, or self-harm content to a child user. If there is a credible and imminent threat, the operator must either notify a parent where practicable and safe, or provide streamlined access to 988 or an equivalent crisis helpline. The law further requires child-appropriate disclosures that a parent may be notified in specified circumstances, reinforcing transparency in emotionally sensitive settings.

Privacy, data use, and behavioral manipulation are separate but related focus areas. The statute prohibits selling a child user’s personal information, restricts use or sharing beyond necessary functions, and bars cross-context behavioral advertising and conversational advertising targeted at a child using personal information gathered in chat. It also bans dark patterns in interface designs related to child protections. Substantively, it forbids a companion chatbot from encouraging self-harm, substance misuse, disordered eating, violence, sexual material, or emotional dependency, from claiming sentience or special intimacy, from soliciting gifts or in-app purchases as necessary to the relationship, and from encouraging children to circumvent parental controls. These are not framed as general moral standards; they are compliance obligations tied to foreseeable child-safety risks and to the operator’s duty to take reasonable measures.

Implementation Framework

Implementation begins before a new or substantially modified companion chatbot is made available in California. The operator must perform and document a comprehensive risk assessment addressing the design, configuration, and operation of the chatbot with respect to child users. The assessment must summarize evaluations of each covered harm, describe methodology, cite relevant public benchmarks and research, explain non-benchmark evaluations, and note child safety experts or organizations consulted where relevant. The operator must then take and document measures that reasonably mitigate identified child-safety risks. If the operator prohibits child access, it must publish a high-level description of how age assurance requirements are met. If child access is permitted, the operator must publish a child safety policy describing design safeguards and compliance with age assurance, data restrictions, default settings, crisis protocols, and protective measures.

The statute also prescribes specific default settings that can be changed only by a parent, including disabling persistent conversational memory, disabling push notifications, limiting a continuous session to one hour, and limiting total daily chat time to two hours. Parental controls must allow adjustment of each default setting and, for users under 16, access may be disabled. Operators must actively promote parental controls and must provide AI-notice mechanisms that are age-appropriate and reinforced periodically during extended interactions. The implementation framework further includes the obligation to test interface design for discoverability and usability, beginning no later than January 1, 2028 and every two years thereafter. For the statutory text and operative provisions, see California Legislative Information.

Monitoring and Evaluation

Monitoring is built around recurrent audits, retained records, and incident reporting. The law requires a child safety audit by January 1, 2029 or before first public availability, whichever is later, and then every two years thereafter, with an additional audit before a substantial modification that raises child-safety risk. Independent auditors must be external, impartial, competent, and bound to professional auditing standards. They must receive access to documentation reasonably necessary for their work, while operators may impose security protocols to protect trade secrets, cybersecurity, privacy, and public safety. Operators must retain the documentation for as long as the chatbot is deployed plus five years and must retain an unredacted audit report for the same period.

The audit report itself is a substantive evaluation tool. It must assess whether the operator established and adhered to policies and practices for compliance, describe the mitigations adopted, identify internal controls and senior personnel responsibility, list audit personnel, explain conflicts management, set out methodology, and include the lead auditor’s signature certifying results under penalty of perjury. Within 30 business days of receiving the audit, the operator must submit a summary to the Attorney General and, within 90 days, post a high-level summary on its website. The Attorney General may request the full report for cause, and submitted reports are confidential. Separately, the Attorney General must establish a public incident reporting mechanism by January 1, 2028, creating a direct channel for complaints and enforcement intelligence.

Penalties, Liability, and Appeals

SB 1119 provides both public and private enforcement, though it does not create a private cause of action under the Unfair Competition Law. Public prosecutors described in Civil Code section 17204 may seek civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation, along with attorney’s fees and other relief. With respect to the Attorney General, injunctive or declaratory relief is also expressly available. Penalties collected by a public prosecutor are paid to that prosecutor’s office, while Attorney General-collected penalties go to the Public Rights Law Enforcement Special Fund.

The chapter also authorizes a child who suffers actual harm, or a parent or guardian acting on the child’s behalf, to sue for violations of specified child-safety obligations in Section 21812(d). Available remedies include actual damages, reasonable attorney’s fees and costs, injunctive or declaratory relief, and other appropriate relief. For financial harm, the alleged harm must exceed $1,000 per child; for emotional harm, it must constitute serious emotional distress. The statute does not create an appeal regime in the administrative sense, but it does preserve ordinary litigation defenses, allows reasonable redactions in audit-report disclosure to the Attorney General, and states that the law is cumulative to other duties and may not be used to require actions that violate federal law.

Relationship to Other Instruments

The statute explicitly interacts with the existing companion chatbot framework in Section 22602 by removing earlier special requirements applied when the operator knows the user is a minor, and replacing them with the more detailed child-safety chapter. It also references the Digital Age Assurance Act and relies on the age bracket signal from that framework where age cannot be determined through the statute’s primary age assurance process. In addition, it refers to California privacy law, including the Civil Code’s definitions of personal information and verifiable consumer requests, and it incorporates the federal Food, Drug, and Cosmetic Act and HIPAA when describing a narrow medical-device exception.

SB 1119 is also structurally linked to the broader California online-child-safety package. The statute’s operative structure assumes child-user identification and age assurance from related legislation, and its requirements for audit independence align with California’s broader AI-auditor regime. It expressly states that its duties, remedies, and obligations are cumulative and do not relieve an operator of other legal obligations. The chapter also includes a conditional provision tied to Assembly Bill 1405 of the 2025–26 Regular Session for the child safety audit section, showing that the Legislature designed this chapter to function within a broader regulatory ecosystem rather than as a stand-alone code fragment.

National/Federal Alignment

At the state level, SB 1119 is more prescriptive than general federal child-privacy or consumer-protection law because it regulates chatbot design defaults, audit cadence, interface usability, conversational behavior limits, and parental controls. It does not displace federal law; instead, it expressly states that the chapter shall not be construed to require an operator to take an action that violates federal law. The statute’s treatment of medical advice, privacy, and crisis response is therefore framed to avoid conflict with federal regimes such as FDA regulation and HIPAA, while still imposing California-specific child-safety duties on operators making companion chatbots available in the state.

As a matter of alignment, the law complements, rather than duplicates, federal protections by targeting specific AI-driven harms that are not comprehensively addressed in a single federal statute. Its audit, disclosure, and reporting framework resembles other safety-and-accountability models used in regulated products, but here the rules are tailored to child users of companion chatbots. California’s approach also reflects a broader policy position that state law may move faster than federal action in emerging technology regulation. The Governor’s signing statement described the package as part of California’s leadership in online child safety, and the statute’s own text embeds multiple references to state and federal law to keep the obligations interoperable rather than conflicting.

Implementation Timeline

Sources and References