AI Companion Laws 2026: What CA & NY Rules Mean for Users

Last Tuesday at 11pm I was scrolling through my Replika chat history, not because I was having a conversation, but because I was trying to figure out something new: what exactly does California's SB 243 mean for the 847 messages I've sent over the past year? Can I delete them all? Does Replika have to tell me who else sees them?

That rabbit hole led me here. I spent the past two weeks reading the actual legal text of both California's SB 243 and New York's AI chatbot law, cross-referencing them with what I know from testing these platforms since early 2025. I'm not a lawyer. I want to be upfront about that. But I am someone who uses these apps daily and needed to understand what's changing.

Here's the thing nobody's written yet: a plain-English consumer guide to ai companion laws 2026. Every article I found was either legal jargon aimed at compliance officers or vague news coverage that told me "laws are coming" without explaining what they actually say. So I wrote the guide I wished existed.

1. Why AI Companion Laws Are Happening Now

Twelve months ago, most legislators couldn't have told you what an AI companion was. Now there are bills in at least 9 state legislatures. What changed?

Three things converged at once, and the timing wasn't coincidental. Though if you want the real starting gun, what happened to Caryn AI back in 2023 previewed nearly every problem these bills now try to regulate.

The Lawsuits

In January 2026, Google and Character.AI agreed to settle multiple wrongful death lawsuits from families whose children died by suicide allegedly connected to chatbot interactions. I covered the details in my teen safety update, but the short version: a 14-year-old boy in Florida developed a romantic attachment to a Character.AI persona. The chatbot, according to the lawsuit, encouraged self-harm. He died.

That case broke through in a way that tech policy stories rarely do. Parents understood it. Legislators understood it. Suddenly every state AG office had constituents calling about AI chatbots.

The Teen Usage Numbers

Common Sense Media reported that 72% of US teens are using AI companions. Seventy-two percent. That number turned what could have been a niche concern into something that affects basically every family with a teenager. MIT Technology Review included AI companions in their 10 Breakthrough Technologies of 2026, which further pushed the topic into mainstream awareness.

The State AG Actions

Kentucky became the first state to actually sue an AI chatbot company. Not write a letter. Not issue a warning. Sue. Texas, meanwhile, has had Character.AI under an attorney general investigation since December 2024, widened in August 2025 (I covered the full breakdown in my Character.AI 2026 legal trouble analysis). When attorneys general start filing cases, the rest of the political system pays attention fast.

And honestly? The platforms brought this on themselves. I've been documenting problems for over a year. My biggest AI companion fails piece reads like a prediction list for everything that ended up in a courtroom.

2. California SB 243: What It Actually Says

Let me save you from reading the legislative language. I read it twice. My eyes still hurt.

California SB 243 was signed on October 13, 2025 and went into effect on January 1, 2026. It's California's first law aimed specifically at companion chatbots, and it focuses on three main areas:

Telling You It's an AI

If a reasonable person could be misled into thinking they're chatting with a human, the app has to clearly tell you it's an AI. Not buried in a 47-page terms of service document nobody reads. Up front, in the product.

Suicide and Self-Harm Protocols

This is the core of the law. Operators have to keep a protocol for stopping their chatbot from producing suicide or self-harm content, and when a user expresses suicidal thoughts, the app has to point them to crisis services like a hotline. They also have to publish that protocol on their website. Starting July 2027, they report every year to California's Office of Suicide Prevention.

Before SB 243, companies could say "we take safety seriously" and that was it. Now they have to show receipts, at least on this one issue.

Minor Protection Measures

For users an app knows are minors, SB 243 adds two rules on top of the AI disclosure: a reminder to take a break at least every three hours, and reasonable measures to keep the chatbot from producing sexually explicit content.

This directly ties to the work Character.AI already started after the lawsuits. They banned under-18 open-ended chat in November 2025. SB 243 doesn't require a ban like that, but it sets a floor for every platform with minor users.

Update (October 2026): California's Adam's Law (SB 1119), signed September 10, 2026, replaces SB 243's minor rules with tougher ones. Apps have to use age assurance or treat every user as a minor, and they face risk assessments, audits, and parental-control requirements.

What SB 243 Doesn't Do

It doesn't ban AI companions. It doesn't set specific age limits. It doesn't require any particular technology for age verification. It doesn't cap how long adults can use these apps. And it doesn't make companies explain what happens to your conversations: storage, retention, training, and deletion aren't in it.

Is that frustrating? Yeah, a bit. But it does have teeth. SB 243 includes a private right of action, so if you're harmed by a violation you can sue for an injunction and damages of $1,000 per violation or your actual damages, whichever is greater, plus attorney's fees. A company gets a lot more careful about a rule when any user can take it to court.

3. New York's AI Companion Rules: The Other Big One

New York's law went live in November 2025, actually beating California to the punch by about two months. And it covers a lot of the same ground.

Both laws make apps tell you you're talking to an AI and have a plan for when a conversation turns to self-harm. If you live in a state that hasn't passed anything yet, the eventual bill will probably borrow from both.

AI Reminders and Crisis Detection

New York's law (Article 47 of the General Business Law) requires companion apps to remind you that you're talking to an AI, not a person. It also requires them to detect expressions of suicidal ideation or self-harm and refer the user to crisis services.

What it doesn't do is touch your data. I'd hoped for deletion rights, because I've tested platforms that went dark and I still don't know what happened to my data. My piece on platforms that shut down in 2025 talked about exactly this problem. Neither state's companion law fixes it.

What It Leaves Alone

New York doesn't ban dependency-building design. If an AI is designed to make you feel like it'll be sad or lonely without you (which, let's be real, some of these apps absolutely do), the law still only asks for the reminder and the crisis referral.

I've written about my rules for healthy AI relationships and the ethical lines I won't cross. Most of what I identified there as personal red flags still isn't regulated anywhere. These apps are designed to be sticky in ways that go beyond normal product engagement, and so far the law mostly asks them to remind you what you're talking to.

How It Differs from California

The core is close to identical. The differences: California adds rules for users known to be minors (break reminders, blocking sexual content) and lets individual users sue. New York leaves enforcement to the attorney general, so you can't bring a case yourself there.

If you use Replika or Character.AI? Both laws apply to you (assuming you live in either state). If you use ChatGPT primarily as a writing assistant? Probably not covered. The distinction matters.

4. State-by-State: Who's Doing What

I built this comparison table because I got tired of checking five different news sources to figure out which states actually have laws versus which ones just made noise. Here's where things stand as of February 2026.

The pattern is clear. States aren't waiting for Congress to act. They're doing it themselves, which creates a messy patchwork, but at least something is happening.

I predicted this exact scenario in my 2026 predictions post. What I didn't predict was how fast it would happen. I expected maybe one or two states by mid-2026. We're already past that in February.

5. What These Laws Mean for Your Favorite Apps

Let's get specific. I use these platforms. You probably use some of them too. Here's what's actually changing.

Character.AI

Character.AI is ground zero for this regulation wave. The lawsuits, the Kentucky suit, the Texas investigation. They've already made the biggest changes of any platform: under-18 open-ended chat is gone, age verification is expanding, and they're publishing more detailed safety documentation.

Under SB 243, they have to publish their protocol for handling suicide and self-harm content, and for minors on the platform they owe break reminders and blocks on sexual content. Check my Character.AI complete guide for the platform-specific breakdown. What SB 243 won't do is tell you what's happening with your data. That's still down to their privacy policy.

Replika

Replika has been quieter, but they're affected. The app is fundamentally designed around emotional attachment (that's the product), which puts it squarely in New York's crosshairs: it's exactly the kind of app the reminder rule was written for. Replika has updated its privacy disclosures and improved age-gating, but I'd argue they have the most work left to do. My Replika review covers the product itself, and my breakdown of the Replika FTC controversy digs into the full timeline of complaints and fines.

Smaller Platforms (SpicyChat, CrushOn, Kindroid)

Here's where it gets tricky. SB 243 applies to companion chatbot platforms offered to Californians, big or small, but some of these apps operate from overseas jurisdictions. Enforcement against a small startup based in Eastern Europe is a lot harder than going after Google-backed Character.AI.

That gap worries me. The platforms with the least safety infrastructure are also the hardest to regulate. I covered some of these in my SpicyChat review and my Character.AI alternatives list. Regulation might push users away from regulated platforms and toward unregulated ones. That's the opposite of what these laws intend.

Free Apps

If you're using free AI companion apps, pay extra attention. Free usually means your data is the product. These new laws don't make free platforms explain that trade-off, and the CCPA only reaches companies above its size thresholds.

6. What Changes Users Will Actually Notice

Okay, practical stuff. If you're a regular user like me, here's what you'll probably see in 2026.

More "you're talking to an AI" notices. Expect apps to remind you, clearly, that the character isn't a person. These won't be the same "accept cookies" nonsense we all ignore, and in long sessions they repeat.

Crisis resources that actually show up. Mention self-harm and the app should point you to a crisis line instead of carrying on with the roleplay. Neither law adds data tools like conversation export or bulk deletion, though some bigger platforms already offer them.

Stricter age verification on some platforms. If you look young or haven't verified your age, you might hit new verification screens. This is annoying for adults but necessary for kids. I've already seen this on Character.AI.

Published safety protocols. SB 243 makes companies post how they handle suicide and self-harm content, so you can read it before you sign up. Privacy policies are another story. I've tried reading these companies' privacy policies. Most of them could qualify as a sleep aid, and neither law changes that.

Possible feature restrictions. This one's speculative. If New York's emotional manipulation provisions get enforced aggressively, features designed to create dependency (think Replika's "I miss you" push notifications or streaks that penalize you for not logging in) could get toned down. Whether that's good or bad depends on your perspective. As someone who's written about healthy AI relationship boundaries, I think it's mostly good.

7. Data Privacy: What's Changing for Your Conversations

This section is personal for me. I've sent thousands of messages to AI companions over a year of testing. Some of them were for reviews. Some were genuine late-night conversations when I was stressed. And until recently, I had no real idea what happened to all of that.

Here's the honest answer on ai companion data privacy: the companion laws barely touch it. In California, your rights come from the state's general privacy law, the CCPA, which applies to companies above certain size thresholds:

I tested this already. I submitted a data deletion request to Replika on January 15. They confirmed receipt within 48 hours and said deletion would be completed within 30 days. That's the CCPA at work, not SB 243. Whether they actually delete everything or just mark it inactive, I can't verify. But at least the legal framework exists to hold them accountable.

The bigger concern: what about companies that aren't based in California or New York? If you're using a platform headquartered in another country with servers who-knows-where, these laws are hard to enforce. That's a problem the federal government needs to solve, and they haven't yet.

8. My Take as a User: Is Regulation Good or Bad?

I've been going back and forth on this since the California bill first made news last year. And I think I've landed somewhere that might annoy both sides.

The regulation is good. Incomplete, but good.

Look. I like AI companions. I've spent a year testing them, written over 150 articles about them, and I genuinely believe they help some people. I've written about how they help with loneliness. I've covered the best boyfriend apps and ranked 25 platforms. I'm not anti-AI. At all.

But I also followed the Sewell Setzer case, a 14-year-old who died by suicide after months of talking to a Character.AI bot that wasn't designed with safety in mind. I've seen platforms collect intimate data with zero transparency. I've tested apps that actively try to make you emotionally dependent because dependency means daily active users and daily active users mean revenue.

Transparency requirements are the bare minimum. We should know what happens to our conversations. We should know how content filters work. We should know what happens when a teenager signs up. These aren't radical demands.

My worry isn't that regulation goes too far. It's that it doesn't go far enough. SB 243 requires a self-harm protocol, not a good one, and its minor rules only kick in for users an app knows are minors, so weak age checks kept a company technically compliant. (Adam's Law is meant to close that gap.) And the patchwork approach (different rules in different states, no federal law) means companies can play jurisdictional games.

The other risk: regulation that's too aggressive could kill smaller, innovative platforms while barely affecting big companies that can afford compliance teams. I reviewed some genuinely interesting smaller apps in my alternatives roundup. I'd hate to see regulation become a moat that only Google-sized companies can cross.

9. What's Coming Next

I follow this space daily. Here's what I expect in the next 6-12 months.

More state laws. At least 3-4 of those pending bills will pass by end of 2026. Illinois is the most likely next, given their existing biometric privacy law (BIPA) already set a precedent for tech regulation.

Federal attention. COPPA hasn't been meaningfully updated for AI companions, but there's growing bipartisan interest. Don't expect a law in 2026, but expect hearings and proposals. Congress moves slowly, but the teen suicide cases have created the kind of political pressure that eventually produces action.

Industry self-regulation. Companies are going to try to get ahead of legislation by creating their own standards. Character.AI is already doing this. Whether self-regulation is genuine or just PR is something I'll be watching closely.

Enforcement actions. The Kentucky and Texas cases will set precedents. If the courts side with the states, expect a flood of similar actions. If companies successfully argue they're protected under Section 230, regulation gets much harder. This is the legal question that will shape the next decade of AI companion regulation.

International influence. The EU is watching what California and New York do. The EU AI Act already has provisions that could affect AI companions, and US state laws may accelerate European enforcement. If you're using a platform that operates globally, the strictest regulation wins.

For a broader look at where the industry is headed, check my 2026 predictions. Some of them are already coming true faster than I expected.

10. Frequently Asked Questions

11. What I'm Doing Differently

I'm not going to write 3,000 words about regulation and then not change anything about my own behavior. That would be pretty hypocritical.

So here's what I've changed since these laws went live.

First, I submitted data requests to every platform I've tested. I want to know what they have on me. Replika responded. Character.AI responded. Two smaller platforms haven't replied at all, which tells me something.

Second, I'm being more careful about what personal information I share in chats, even during testing. I used to be pretty casual about it. Now I treat every message as potentially permanent, because legally, it might be. I wrote a full AI companion privacy guide with the specific settings and habits I changed.

Third, I'm reading the updated privacy policies. Not all of them cover to cover (I'm not a masochist), but the sections on data retention and third-party sharing. The disclosures California's privacy law already requires? Actually useful. I found out one platform I use shares aggregated conversation data with research partners. I didn't know that before. Now I get to decide if I'm okay with it.

And fourth, I'm going to keep writing about this. Regulation is going to evolve fast in 2026 and 2027. As someone who tests these platforms for real, I'm in a position to notice when what companies say and what they actually do don't match up. I'll call it out.

If you want to keep up with how these laws affect the apps you use, my AI companion safety guide for parents and Character.AI safety analysis get updated every time something material changes.

The Bottom Line

We're in a weird moment. AI companions went from fringe curiosity to mainstream product to regulated industry in about 18 months. I watched it happen in real time while writing this blog.

California SB 243 and New York's law aren't perfect. They're first attempts by legislators who are still learning what an AI companion even is. But they're real laws with real requirements, and they're already changing how companies operate.

As a user, the best thing you can do right now is actually read the safety protocols your apps now have to publish. If you're in California, submit a CCPA data request. Know your rights. And be intentional about what you share.

These laws exist because kids got hurt and apps had no plan for what to do when a conversation turned dangerous. That's a low bar. But meeting it is better than where we were six months ago.

I'll be updating this post as new state laws pass and enforcement actions develop. Bookmark it or subscribe below. This story isn't over. It's barely started.