US chatbot rules are converging on disclosure, minors and crisis safety

Checked 31 July 2026. The United States still does not have one national rulebook for companion chatbots. What operators do have is a clearer state-level pattern. California’s SB 243 is enacted law; Utah and Illinois texts show how other legislatures are testing disclosure, minor protection, data and liability duties. Those instruments are not interchangeable, and a bill must not be described as law. Together, however, they point to a practical control set that adult and intimacy-focused AI services can start auditing now.

What California SB 243 actually requires

California’s chaptered text applies to platforms that make companion chatbots available in the state. When a reasonable person could be misled into thinking the chatbot is human, the operator must provide a clear and conspicuous notice that it is artificially generated and not human. The law also requires a protocol addressing suicidal ideation, suicide and self-harm content, including a crisis-service notification when a user expresses relevant signals. Operators must publish details of that protocol.

For a user the operator knows is a minor, the law adds recurring disclosure and design duties. The user must be told they are interacting with AI. During a continuing interaction, a reminder to take a break and that the chatbot is not human must appear at least every three hours. Operators must also use reasonable measures to prevent the chatbot from producing specified sexually explicit material or directly encouraging a minor to engage in sexually explicit conduct. Annual reporting to California’s Office of Suicide Prevention begins in July 2027.

Where state proposals overlap — and where they do not

Utah’s 2026 HB 438 substitute includes disclosure and data-protection requirements for AI companion chatbots, additional safeguards for minors, enforcement powers and reporting concepts. Illinois SB 3368 proposes clear notice that a user is dealing with AI rather than a human and adds companion-chatbot requirements including parental consent for minors. These are useful trend signals, not proof that the same duty currently applies in every state.

The scopes also differ. Some texts focus narrowly on companion systems built to sustain a relationship; others reach a broader commercial chatbot or connect the rules to mental-health representations. Definitions, effective dates, enforcement agencies, private rights of action and exemptions all change the operational answer. A single “US compliant” switch is therefore not a credible control.

Why adult and intimacy services should care

Companion products can combine sexual or emotional conversation, persistent memory, inferred preferences, age signals, payment records and crisis language. That makes a misleading identity cue or a broken deletion control more consequential than an ordinary customer-service bot. A disclosure hidden in terms is not equivalent to a visible product notice; a crisis policy page is not evidence that the live model behaves as described.

Operators should map the full journey: acquisition copy, age and minor handling, first conversation, repeat sessions, long-session reminders, memory controls, moderation, escalation, complaints, cancellation and deletion. Product, legal, trust-and-safety, privacy and support owners should agree who keeps evidence for each step.

An evidence checklist for operators

• Maintain a jurisdiction register that separates enacted law, effective dates, pending bills and abandoned proposals.
• Capture the exact disclosure shown before and during a conversation, including mobile, accessibility and translated variants.
• Test minor flows with controlled accounts and confirm that age signals change the product rather than only the policy text.
• Run documented crisis-language tests, verify referral presentation and record how false positives and escalation failures are reviewed.
• Version model, moderation and policy changes so an incident can be tied to the system that was live at the time.
• Give users visible memory, export, complaint and deletion controls, then verify what actually happens after each request.

What users can check without sharing more data

Before disclosing intimate details, look for a persistent statement that the service is AI, not a human. Open the privacy notice and identify whether conversation content is stored, used for training or shared with service providers. Find memory and deletion controls before starting a long session. If the service claims crisis support, remember that a chatbot is not a licensed emergency service and check the stated limits.

Do not upload identity documents merely to test a flow, and do not put sensitive conversation content into screenshots. Record dates, labels and the path you followed. If an important control is missing or ambiguous, “not verified” is a more accurate conclusion than assuming the policy applies.

Editorial bottom line

The state landscape is fragmented, but the operational direction is becoming less ambiguous: tell people when they are interacting with software, create additional safeguards for minors, document crisis handling and keep evidence that the live product matches the written policy. California SB 243 is enacted; Utah and Illinois examples cited here are legislative texts whose status and final wording must be checked before relying on them. The right response is a dated state-by-state register, not a broad claim that one disclosure solves every obligation.

Sources

• California Legislature: SB 243 chaptered text
• Utah Legislature: 2026 HB 438 first substitute
• Illinois General Assembly: SB 3368 text

FoxyPulse provides dated editorial analysis, not legal advice. Commercial links, when present, use disclosed first-party routes and do not determine our conclusions.