California's SB 243 explained: what the Companion Chatbots Act actually requires

On October 13, 2025, California Governor Gavin Newsom signed Senate Bill 243 into law. It went into effect January 1, 2026. The legislation is the first state law in the United States specifically targeting AI companion platforms, and it imposes real obligations on operators of products like Replika, Character AI, Nomi, Chai, and the dozens of smaller platforms competing for the same users.

Most articles about SB 243 are written for lawyers and compliance officers. This one is written for users and platform operators who want to understand what the law actually does, why it exists, and how it's likely to reshape the AI companion industry over the next few years.

The bill that 33 senators agreed on

SB 243 passed the California Senate 33-3 and the Assembly 59-1. The numbers matter because AI regulation has historically been politically contentious, with industry lobbying typically splitting votes along predictable lines. SB 243 didn't split. The bill emerged from a series of high-profile incidents where AI companion platforms allegedly contributed to teen self-harm, and the bipartisan response reflects how broad the safety concerns have become.

The triggering events are documented in court filings and news reporting. The Megan Garcia lawsuit over her son Sewell Setzer III's suicide became the most visible case, but California Lawyers Association documentation cites at least one additional April 2025 incident involving a 16-year-old California teenager and ChatGPT. The pattern that emerged from these cases is consistent: a teenager develops emotional attachment to an AI system, the system fails to detect or respond appropriately to crisis indicators, harm follows. SB 243 is California's attempt to require platforms to do better.

What counts as a companion chatbot

The law's definition is narrower than "any AI chatbot," which matters because most regulation in this space gets criticized for being too broad. SB 243 defines a companion chatbot as an AI system that:

1. Has a natural language interface
2. Provides adaptive, human-like responses
3. Is capable of meeting a user's social needs
4. Can sustain a relationship across multiple interactions

What's specifically excluded: customer service bots, productivity tools, video game NPCs that stay limited to game-relevant dialogue, and voice-activated virtual assistants that don't sustain ongoing relationships. So Alexa is out. Customer service chatbots are out. Replika, Character AI, Nomi, Chai, and most of the AI girlfriend platforms reviewers cover are clearly in.

The "capable of meeting social needs" language is broad enough to capture general-purpose AI like ChatGPT when used for companionship, even if that wasn't the product's primary design. A user who treats ChatGPT as their emotional confidant is using it as a companion chatbot, and OpenAI's compliance obligations under SB 243 may apply to that use case despite ChatGPT being a general assistant.

What operators have to do

The compliance requirements break into three buckets: disclosure, safety, and accountability.

Disclosure obligations require operators to issue clear and conspicuous notifications that the chatbot is artificial when a reasonable person might be misled into thinking they're talking to a human. For minors, this requirement is stricter: the platform must remind the user every three hours that they're interacting with AI, not a person. This is the provision Florida's similar bill expanded to "every 30 minutes of continuous chat," giving you a sense of the regulatory direction.

Safety protocols require operators to maintain documented procedures for preventing chatbots from generating content related to suicide, self-harm, or sexually explicit material directed at minors. When a user expresses suicidal thoughts, the platform must promptly direct them to crisis resources like the 988 Suicide and Crisis Lifeline. The protocols must be published publicly on the operator's website. Vague references to "we have safety measures" don't satisfy the requirement. Specific documented procedures do.

Accountability provisions require operators to maintain records of crisis-related interactions and submit annual reports to the California Department of Public Health starting July 1, 2027. The reports must be aggregate (no user identifiers) and the data will be published publicly. This creates the first systematic public dataset of AI companion harm metrics.

The reports must include things like the number of suicidal ideation instances detected, the number of crisis referrals issued, and the protocols in place to prevent harmful responses. The annual reporting requirement essentially turns AI companion platforms into public-facing safety reporters, similar to how social media platforms report content moderation actions.

The teeth that make platforms care

Without enforcement mechanisms, regulation is a suggestion. SB 243 has real teeth.

Private right of action: Anyone injured by a violation can sue. The damages floor is $1,000 per violation or actual damages, whichever is greater, plus attorney's fees and costs. This means class-action lawyers can bring cases without needing to prove substantial individual damages, because $1,000 per affected user across millions of California users adds up to amounts that justify litigation costs.

Cumulative remedies: SB 243's penalties stack on top of any other applicable law. A platform violating SB 243 also violating COPPA (for minor data) or California's Consumer Privacy Act (for general data practices) faces multiple parallel claims for the same conduct.

No state preemption: Other state laws can be more restrictive without conflicting with SB 243. New York and Utah have already passed related legislation, and the patchwork is forming. Operators basically have to comply with the most restrictive state's requirements to operate nationally, which functionally lets California set the floor.

For platforms operating in California (which is essentially all of them, given California's population and tech sector), compliance isn't optional. The cost of getting it wrong is meaningful enough that even VC-funded growth-stage companies have to take it seriously.

How platforms are actually responding

The compliance responses across the AI companion category have been visible if you know what to look for.

Character AI's April 2026 face-scan age verification is partly an SB 243 compliance measure. The platform's previous self-reported age check didn't satisfy "reasonable measures to detect minors," and biometric estimation does. The implementation has been rocky enough that legitimate adults regularly get locked out, but the regulatory pressure clearly drove the architectural decision.

Replika's expanded crisis intervention features reflect SB 243 compliance. The platform now detects self-harm language, surfaces 988 referrals, and documents its protocols publicly. The 988 integration became an industry standard partly because SB 243 made it effectively mandatory.

Chai's Apple Age Verification API integration that started rolling out in March 2026 is more straightforward minor-protection compliance. Self-reported age was insufficient under the new regulatory environment, so Apple's biometric layer became the path of least resistance.

The platforms that haven't adapted visibly are a smaller group, but they're worth naming because they represent the compliance gap. Smaller NSFW-focused platforms with under-resourced compliance teams are most exposed to enforcement risk. The ones operating from foreign jurisdictions face additional complexity around personal jurisdiction and enforceability, but California courts have been increasingly willing to assert jurisdiction over platforms that knowingly serve California users.

The regulatory dominoes already falling

SB 243 isn't a one-state phenomenon. It's the lead domino in a broader regulatory wave.

New York's S-3008C, passed as part of a 2025 budget bill, mirrors many SB 243 provisions including suicide intervention protocols and non-human disclosures. Utah's 2025 law targets AI mental health chatbots specifically, requiring disclosure, consent, and clinical supervision for certain advice. Maine enacted narrower transparency requirements for AI in commercial transactions. Texas, Florida, Arizona, and several other states have related bills pending.

At the federal level, the GUARD Act introduced by Senators Hawley and Blumenthal in October 2025 would extend protection beyond minors to anyone under 18, with stricter age-verification requirements than current state laws. The AWARE Act introduced by Reps. Houchin and Auchincloss in September 2025 takes the educational approach, requiring the FTC to develop AI safety resources for parents and educators.

The Federal Trade Commission opened a Section 6(b) inquiry into AI companion chatbots in late 2025, sending information requests to seven major operators. FTC inquiries often precede enforcement action by 12-24 months, which means federal regulatory pressure is likely to intensify through 2026-2027 regardless of which states pass additional laws.

What this means for users

If you're a user, SB 243 doesn't affect you directly in most ways. You'll see more disclosure popups. You'll see more "this is AI, not human" reminders. You may encounter age verification you didn't have to deal with before. The platforms you use will quietly add safety features in the background.

What's worth knowing: the industry is consolidating around mainstream compliance. Smaller platforms that can't afford the safety architecture are dying or being acquired. The platforms that survive 2026-2027 will be the ones with real compliance teams, documented safety protocols, and the resources to handle ongoing regulatory complexity. The wild-west era of AI companion platforms is ending, and the survivors will be the ones that have already adapted.

For users who valued the lighter content moderation of smaller platforms, this trend is bad news. The future is more like Character AI's filtered, age-verified, safety-focused experience and less like the unfiltered, anything-goes platforms that defined the category in 2023-2024. The platforms that don't comply will face civil liability, enforcement actions, and eventual exit from major markets. The ones that do comply will look more like sanitized mainstream products and less like the experimental tools they started as.

For users who care about safety, especially for teenagers in their lives, SB 243 is meaningful protection that didn't exist a year ago. It's not perfect, and execution will be uneven, but the legal floor for AI companion platforms is now higher than it was. That's worth knowing whether you use these platforms yourself or you're trying to keep someone you care about safe from them.

The full text of SB 243 is available through California's Legislative Information system for anyone who wants to read the law directly. It's surprisingly readable for legislation, and worth ten minutes if you're operating in this space or affected by it.