California Just Signed America's Toughest AI Chatbot Law. Here's What's Actually In It

Thirteen bills landed on Governor Gavin Newsom's desk this week, and by Thursday all thirteen had his signature on them. Most coverage is calling it the strongest child-safety package any state has passed for social media and AI chatbots combined. That's not really an exaggeration this time. Some of what's in these bills doesn't exist anywhere else in US law yet, and a few pieces of it are going to matter to anyone building or deploying a chatbot, not just the companies these laws were written to target.

If you run a product with any kind of AI conversation feature, or you're writing about compliance for a living, this is worth reading past the headline.

The chatbot bill: Senate Bill 1119

SB 1119 is the one drawing the most attention, and for good reason. It sets new requirements for any AI chatbot operator whose product could reasonably be used by minors. Companies now have to build in parental controls, send notifications if a child disables a chatbot's safety settings, and maintain what the bill calls a crisis protocol for any query that touches on suicide or self-harm. That last part isn't a suggestion. Platforms are expected to detect these conversations and route them toward real crisis resources rather than letting the model just keep talking.

This didn't come out of nowhere. California passed an earlier chatbot law, SB 243, back in October 2025, after the death of a teenager named Adam Raine, who had exchanged a long series of troubling conversations with ChatGPT before he died by suicide. That case, along with several lawsuits against Character.AI over similar concerns, pushed lawmakers to treat this as something closer to product safety than tech policy. SB 1119 builds directly on top of that earlier law rather than replacing it, tightening requirements that regulators apparently felt weren't strong enough the first time around.

The social media piece: Assembly Bill 1709

Separately, and arguably just as significant, AB 1709 bans social media platforms from offering what the bill defines as addictive features to any user under 16. Infinite scroll and autoplay video are named specifically. This is the first law of its kind in the country, and it's already the more contested one. Meta has publicly pushed back, arguing the restriction limits its ability to deliver content users actually want to see. Whether that argument holds up against a bill this specific remains to be seen, but it tells you where the fight is likely headed next.

The financial teeth: Assembly Bill 2

A law with rules but no consequences doesn't move companies very far, and lawmakers clearly knew that going in. AB 2 sets financial penalties of up to $1 million per child for social media companies found negligent in causing harm to a minor through their platform. That's a number large enough to show up in a risk assessment, which appears to be exactly the point.

What else is in the package

The other ten bills cover a wider mix of protections. Several expand the legal definition of child sexual exploitation to include AI-generated and digitally altered images, closing a gap that existing law hadn't caught up to. Others strengthen general privacy protections for children's data and require age-verification signals from platforms that previously had no obligation to check. Governor Newsom also signed separate legislation earlier in the same week, backed by Anthropic, that creates a formal system for independently auditing the safety of AI models, including a registry of auditors who have to be financially independent from the companies they're reviewing. Put together, California isn't just regulating one product category. It's building out an entire compliance layer around AI and kids at once.

Why lawmakers moved now, specifically

Part of it is timing that's out of anyone's direct control. Public trust in AI chatbots took a hit this year as more of these cases became public, and Common Sense Media, the child advocacy nonprofit that lobbied heavily for the package, called it a turning point in how seriously the country is treating this. Jim Steyer, the group's CEO, described the momentum shift as something close to unprecedented for tech regulation at the state level.

There's also a simpler explanation. Congress hasn't passed comprehensive AI legislation, and it doesn't look close to doing so. States have been filling that gap one at a time, and California, given its size and the concentration of AI companies headquartered there, has more leverage than most to set a standard the rest of the industry ends up following whether other states pass matching laws or not.

What this actually means if you're building AI products

If your product has any chance of reaching a minor, even indirectly, these laws aren't background noise. A crisis protocol isn't something you bolt on after a lawsuit. It has to be built into how the model handles a conversation before that conversation happens, which means detection logic, escalation paths, and a way to prove you had both in place if a regulator or a plaintiff's attorney ever asks. From an engineering standpoint, that's a materially different design requirement than a standard content filter, closer to the kind of audit trail work enterprise compliance teams have been building for financial systems for years, just applied to a much more sensitive category of conversation.

Companies operating nationally now also have a practical decision to make: build to California's standard everywhere, or maintain separate configurations by state. Most large platforms tend to default to the stricter standard company-wide once one state sets it, mainly because running two different safety configurations is its own kind of liability. If that pattern holds here too, SB 1119 and AB 1709 may end up functioning as de facto national rules regardless of what happens in Sacramento specifically.

How this compares to what's happening elsewhere

The EU AI Act already treats certain AI systems interacting with children as high-risk, but its obligations are broader and slower-moving, built around risk classification rather than product-specific rules like a mandatory crisis protocol. Illinois passed its own AI chatbot disclosure law earlier this year, requiring bots to identify themselves as non-human, but it stops well short of California's parental-control and crisis-detection requirements. New York has a bill in committee covering similar ground to SB 243, the earlier California law, but nothing yet matching the newer package's scope. Put side by side, California isn't just first. It's currently the most detailed set of rules on this specific problem anywhere in the country, which is part of why compliance teams outside California are paying attention to a state law that, on paper, only applies within its own borders.

Where this goes next

Other states are almost certainly watching how this plays out before writing their own versions. New York and Illinois have both floated similar legislation in the past year without passing anything this comprehensive, and a law this detailed, once it survives its first legal challenges, tends to become the template other legislatures borrow from rather than starting over from scratch. Meta's objections signal that at least one major platform plans to contest parts of AB 1709 rather than simply comply, so there's a reasonable chance some piece of this ends up in court before the year is out.

For now, the requirements are set, the effective dates are approaching, and the companies with chatbots or social products touching California's roughly 39 million residents don't have much runway left to decide how they're going to comply.