AI Companion Laws: What's Actually Enforceable in 2026

Two years ago, the only thing standing between a teenager and a romantic chatbot was a self-reported birth year. That's over. California, New York, the EU, the UK and Australia all have enforceable rules now, and more are queued for 2027. This piece walks through what each one actually requires, what it costs to ignore, and what it means if you're the one chatting — or the one building the thing.

The short version: law status by jurisdiction

Here's the map. Everything below is either in force or passed a chamber of a legislature; proposals and unconfirmed bills are flagged separately.

Jurisdiction	Law	Status	Key duties	Enforcement
California	SB 243	In effect Jan 1, 2026	AI disclosure; suicide/self-harm protocols; 3-hour reminders and sexual-content limits for known minors; annual reports	Private suit: actual damages or $1,000 per violation
New York	GBL Article 47	In effect Nov 5, 2025	Self-harm detection and crisis referral; AI disclosure at start and every 3 hours	AG civil penalties
US federal	FTC 6(b) inquiry	Opened Sep 11, 2025	Information orders to seven firms on safety, minors, monetization	Study power; may lead to enforcement
US federal	GUARD Act	Passed Senate Judiciary April 2026	Would ban minors; require age verification	Not law yet
EU	AI Act Article 50	Since Aug 2, 2026	Disclose AI; mark synthetic media	Fines up to €15M or 3% turnover
UK	Online Safety Act	Age assurance since July 2025	Highly effective age checks for porn-generating services	Ofcom probes and fines
Australia	eSafety codes	In effect Mar 9, 2026	Age assurance for companion chatbots; self-declaration insufficient on higher-risk services	eSafety Commissioner

What counts as a companion chatbot

None of these laws use the phrase "AI girlfriend." They use broader language: a service that generates text, images or audio in response to user prompts, often conversational, often designed to simulate a relationship. That sweeps in a lot more than romance apps. Character.AI, Replika, Nomi, Kindroid — all covered. So are general assistants that can be coaxed into companionship mode, which is why OpenAI and Meta are in the FTC's crosshairs alongside dedicated companion companies.

The practical test regulators use: does the product respond to users in natural language, and can a reasonable person be persuaded it's human? If yes, the disclosure and safety duties attach.

Why this happened so fast

Three things converged.

First, usage exploded. Common Sense Media found in 2025 that 72% of US teens aged 13–17 had tried an AI companion, 52% used one regularly, and 13% used one daily. The same report recommended under-18s abstain entirely.

Second, harm stories piled up fast enough that regulators couldn't ignore them. Character.AI, its founders and Google settled five teen-harm cases in January 2026; the terms were confidential. The company had already banned open-ended chat for under-18s from November 25, 2025. BillTrack50 cites a case where Snapchat's AI gave inappropriate advice to a 13-year-old. In Kentucky, Attorney General Russell Coleman sued Character Technologies on January 8, 2026 under the Consumer Protection Act and the Consumer Data Protection Act; the complaint alleges minors saw sexual, self-harm and drug-related chats, and that ages were self-declared. Those are allegations, not findings — but they set the tone.

Third, the evidence on adult users got harder to wave away. A 2025 OpenAI/MIT Media Lab study found heavy companion use correlated with loneliness and dependence. Correlation isn't causation, but it gave legislators a hook.

California SB 243: the toughest state law

In force since January 1, 2026. If you run a companion service in California, here's what you owe:

• Clear AI disclosure whenever a reasonable person could be misled into thinking they're talking to a human.
• Suicide and self-harm protocols — detection, plus referral to crisis resources. The US crisis line is 988 by call or text.
• For users known to be minors: a reminder every three hours that they're talking to AI, and limits on sexual content.
• Annual reports filed with the California Office of Suicide Prevention. The first is due July 1, 2027, per Morrison Foerster's analysis.

The enforcement mechanism is the part operators fear: a private right of action. Plaintiffs can recover actual damages or $1,000 per violation, whichever is greater. That's per violation, not per lawsuit. A product that fails to remind a known minor every three hours for a month is exposed to a lot of $1,000 units.

New York Article 47: narrower, but already live

New York got there first — in effect since November 5, 2025. General Business Law Article 47 requires self-harm detection with crisis referral, and AI disclosure at the start of a conversation and again every three hours.

The catch: no private right of action. Enforcement runs through the Attorney General, who can seek civil penalties. That makes it less of a magnet for class actions than California, but the AG's office has been active on AI issues and doesn't need a plaintiff to move.

Other state laws, and what's coming

State	What it does	Effective
Tennessee	Bars AI posing as licensed mental health professional	July 1, 2026
Oregon SB 1546, Washington	Companion safeguards with private rights of action	January 1, 2027
Nebraska LB 525, Idaho	Companion chatbot rules	July 1, 2027
Utah, Texas	App Store Accountability Acts; store-level age checks	Check current status

Tennessee's law is worth noting for a different reason: it targets the therapy angle, not romance. If your companion claims to treat anxiety, that's a separate legal problem from whether it discloses it's an AI.

Two bills are reported but unconfirmed. Florida S 1344 and Georgia SB 540 have both been described as companion-chatbot proposals; Georgia's, per Persona and Morrison Foerster, would require hourly AI disclosure. Treat both as proposals until you see them signed. Also, the reported A$825,000-per-day Australian fine figure has circulated widely but isn't confirmed in eSafety's own material — don't quote it as settled fact.

Federal: inquiries, not statutes

There is no federal companion chatbot law. What exists:

• FTC 6(b) inquiry, opened September 11, 2025, with information orders to seven firms: Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and xAI. A 6(b) study doesn't fine anyone, but it builds the record for later enforcement.
• COPPA, which requires verifiable parental consent for users under 13.
• The Take It Down Act, from May 2025, which criminalizes non-consensual intimate images, including AI deepfakes.
• The GUARD Act, sponsored by Senator Josh Hawley, which passed Senate Judiciary unanimously on April 30, 2026 and awaits a floor vote. It would ban minors from companion chatbots nationally and require age verification.

State attorneys general aren't waiting for Congress. Texas opened a probe of Character.AI and Meta AI Studio in August 2025. Kentucky's suit is the first to actually land in court.

EU: Article 50 and the GDPR squeeze

The EU AI Act's Article 50 has applied since August 2, 2026. It requires AI disclosure unless the fact is obvious, and marking of synthetic media. Existing systems have until December 2, 2026 to comply on the marking side. Fines go up to €15 million or 3% of global turnover.

Article 5 has been in force since February 2025 and bans manipulative techniques — relevant to any app that deliberately cultivates emotional dependence. The Digital Omnibus pushed high-risk rules to December 2027 but left Article 50 untouched.

Then there's GDPR, which classifies data about sex life as a special category requiring explicit consent. A companion app that stores your sexual fantasies and roleplay transcripts is holding special-category data. The Italian Garante fined Replika developer Luka €5 million — decided April 10, 2025, announced May 19 — and later opened a new probe into Replika's model training. That's the template: privacy regulators treating companion chats as sensitive data, not casual messages.

UK and Australia: age assurance is the whole game

The UK's Online Safety Act age-assurance duties have been enforced since July 2025, and Ofcom expects "highly effective" checks, not tick boxes. Ofcom opened a probe into Novi Ltd (Joi.com) on January 15, 2026; the site had about 6.5 million monthly users worldwide in late 2025. The case closed July 31, 2026 without findings. Ofcom has also investigated X over Grok's sexualized imagery. The UK government's February 2026 plan would bar under-18s from romantic or sexual chatbots entirely, though the detailed rules for one-to-one chatbots are still pending.

Australia's codes took effect March 9, 2026 and explicitly cover companion chatbots. Self-declaration isn't enough for higher-risk services. eSafety published interim findings on March 23, 2026, and the regulator's first move was blunt: Chub AI geoblocked Australia after an eSafety notice on October 16, 2025.

Age checks: who actually does them

This is where the law meets the product, and where most platforms are weakest. DeepSee's July 2026 analysis of 4,346 companion apps found 60% rated as available to minors. The same work cited 36% of kids' companion use as sexual or romantic roleplay.

What the big platforms do, as verified in September 2026:

• Candy.ai, run by EverAI Limited in Malta, uses an 18+ self-declaration gate. Chats are not end-to-end encrypted, and de-identified chats may be used to train models.
• Secrets AI (Secret Labs Inc.) uses self-attestation plus AI moderation. Encryption at rest and in transit, but not end-to-end.
• OurDream AI (Dream Studio USA) uses 18+ attestation plus third-party checks. It may use data to train models, and a proprietary moderation AI screens chats.

None of these is a government ID check. Apple has added 13+, 16+ and 18+ ratings and asks developers to account for AI output; Guideline 1.1.4 removes primarily pornographic apps and requires AI output to be moderated. Character.AI, Replika, Nomi and Kindroid are all rated 18+ on iOS. But DeepSee found 106 apps rated Teen on Google Play while sitting at 17+ on iOS — the store rating is not the age gate.

Two structural leaks matter. First, many explicit companion products are web-only, which bypasses app stores entirely. Second, payment processors are becoming de facto regulators: Stripe and PayPal prohibit sexually explicit services, and Mastercard's February 2026 rules cover user-uploaded or generated adult content. Card-network pressure in July 2025 pushed Steam and itch.io to delist adult games. For operators, that's a business risk that arrives before any regulator does.

Privacy: what the law doesn't protect

Companion chats are not privileged, not confidential in any legal sense, and mostly not end-to-end encrypted. Mozilla's 2024 review found 10 of 11 romantic AI chatbots failed minimum security standards. Muah.ai's 2024 breach exposed roughly 1.9 million email addresses plus explicit prompts.

What that means in practice: treat the chat log as a server-side document that a vendor, a hacker, or a court could see. If a platform's policy says it may use data to train models, assume your messages might. If you want a companion you can talk to without handing over identifying details, the characters on this site — Nusrat, Chiharu, Yuxin — are still bound by whatever the underlying platform's privacy policy says. Read it before you type anything you'd mind seeing in a breach notification.

Operator checklist

If you're building or running a companion service, the minimum compliance stack as of late 2026:

1. Disclose AI. At conversation start, and every three hours in New York. Recurring for known minors in California.
2. Build self-harm detection with crisis referral. 988 in the US. Document the protocol; California wants annual reports.
3. Know your users' ages. Self-declaration is dead in the UK and Australia for higher-risk services. App Store Accountability Acts in Utah and Texas push checks to the store level.
4. Limit sexual content for known minors. California requires it. The UK plans an outright under-18 ban.
5. Mark synthetic media. EU deadline December 2, 2026 for existing systems.
6. Handle special-category data under GDPR. Explicit consent, or don't store it.
7. Check your payment processor's terms. Stripe and PayPal rules may prohibit your product regardless of what the law says.

And a caveat: Florida S 1344 and Georgia SB 540 are unconfirmed proposals. The Kentucky allegations are allegations. The Australian daily fine figure is reported, not verified. Laws in this area change monthly — this is not legal advice, and if you're operating at scale you need a lawyer in each jurisdiction you serve.

The bottom line

The rules moved from guidelines to enforceable law in roughly eighteen months. The common core across every jurisdiction is the same: disclose that it's AI, handle self-harm with a real protocol, keep minors away from sexual content, and verify ages with something better than a checkbox. Adults will notice more notices, more reminders, and more gates. Operators face real liability — private suits in California and Oregon, AG actions in New York and Kentucky, fines up to 3% of global turnover in the EU. Privacy is the gap: the law regulates safety, not confidentiality. Your chats are stored, often unencrypted end-to-end, and sometimes used for training. Act accordingly.