Deploys a companion chatbot, in California

Cal. Bus. and Prof. Code Sections 17940 to 17943 · Read the law's page

• Clearly and conspicuously disclose that the user is interacting with a bot, which is the statute's safe harbor
• The prohibition reaches using a bot to mislead a Californian about its artificial identity in order to incentivize a commercial transaction or influence a vote

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

Cal. Bus. and Prof. Code Sections 22601 to 22606 · Read the law's page

• If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
• Do not let a companion chatbot on your platform engage with users unless you maintain, and publish on your website, a protocol for preventing it from producing suicidal ideation, suicide, or self-harm content, including a notification referring the user to a crisis hotline or crisis text line
• For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective January 1, 2027)
• For a user you know is a minor, take reasonable measures to prevent your companion chatbot from producing visual sexually explicit material or directly telling the minor to engage in sexually explicit conduct (Section 22602(c)(3), deleted by SB 1119 effective January 1, 2027)
• Disclose, wherever a user can access your companion chatbot platform, that companion chatbots may not be suitable for some minors (Section 22604)
• Beginning 1 July 2027, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information
• A companion chatbot used only for customer service, internal business purposes, or as a limited video-game feature, or a stand-alone voice-command consumer device that does not sustain a relationship across interactions, falls outside this chapter

Cal. Bus. and Prof. Code Sections 4999.8 and 4999.9 · Read the law's page

• Do not use a term, letter or phrase in the advertising or functionality of your AI or generative AI system, program, device or similar technology that indicates or implies that the care, advice, reports or assessments it offers are provided by a natural person who holds the appropriate license or certificate to practice as a health care professional (Section 4999.9(c)).
• Do not use in the advertising or functionality of your AI or generative AI system a term, letter or phrase that the Business and Professions Code reserves to licensees of a health care profession to indicate or imply a license or certificate you do not hold; those prohibitions are enforceable against the person or entity that develops or deploys the system (Section 4999.9(b)).

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Bus. and Prof. Code Sections 22757 to 22757.6 · Read the law's page

• Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the content
• To the extent it is technically feasible, embed in image, video, and audio content your system creates or alters a latent disclosure carrying your name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content, and make it permanent or extraordinarily difficult to remove
• Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that
• If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney General
• Do not falsely represent that your generative AI system is designed to primarily function as assistive technology
• If you run a large online platform, from 1 January 2027 detect provenance data in content distributed on it, show users a clear indication of whether any system provenance data or digital signature identifies the content as generated, substantially altered, or captured by a device, let users inspect that data, and, to the extent technically feasible, do not knowingly strip it
• If you manufacture a capture device that you first produce for sale in California on or after 1 January 2028, provide users the option to include in captured content a latent disclosure naming you as manufacturer, the device's name and version, and the time and date of the content's creation or alteration, and embed latent disclosures in captured content by default, to the extent technically feasible and compliant with widely adopted specifications
• Later phases add duties for GenAI hosting platforms from 1 January 2027

Cal. Penal Code §§ 631, 632, 632.7, 633.5, 637.2 · Read the law's page

• Do not tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.
• Get the consent of every party before using an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether the parties are in each other's presence or on a call; a communication is confidential where a party has an objectively reasonable expectation it is not being overheard or recorded, and disclosing that you are listening or recording, so that every party knows it, takes the recording outside this duty.
• Get the consent of every party before intercepting or recording a communication transmitted between a cellular or cordless telephone and another telephone; this reaches you even if you are a party to the call yourself, not only a third party who intercepts it.
• Section 633.5 lets a party record without the others' consent only where the party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony (including human trafficking), a violation of Section 653m, or domestic violence; it is not a business or compliance exception, so get every party's consent for any other recording.
• These duties do not reach a public utility or telephone company, or its officers, employees, or agents, acting to construct, maintain, conduct, or operate its own communications services and facilities; this exemption does not reach a general business messaging its own customers.
• This all-party consent rule reaches a business's routine recording, from an office outside California, of calls with a party in California; the California Supreme Court has not decided how its choice-of-law analysis applies to an isolated personal call recorded from outside California, or to a recording made because of a reasonable, individualized belief that a caller is engaged in wrongdoing.

Cal. Bus. & Prof. Code § 22650 et seq. (SB 11, 2025–2026 Reg. Sess.)

• This law is enacted but does not take effect until 1 December 2026; what follows applies from that date.
• If you make available AI technology capable of creating digital replicas of real people, display a consumer warning stating that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user.
• If you make available AI technology capable of creating digital replicas of real people, hyperlink that warning on the pages where users enter prompts.
• If you make available AI technology capable of creating digital replicas of real people, include that warning in your terms and conditions.

Cal. Bus. & Prof. Code §§ 21810-21818 · Read the law's page

• Applies to an operator, a person who makes a companion chatbot available to a user in the state, other than a postsecondary educational institution that makes one available exclusively for educational settings and an entity that makes one available exclusively to its personnel for workplace use.
• Determine the age of each user under the Digital Age Assurance Act; if that cannot be done, rely on the age determination made under Health and Safety Code Section 27001; otherwise apply the child protections of Sections 21812(d) and 21813 to all users.
• Before making a new or substantially modified companion chatbot available, perform and document a comprehensive risk assessment of covered harms to child users, and take and document measures that reasonably mitigate the child safety risks it identifies.
• Publish on the operator's website a description of how it complies with the age assurance requirements if it prohibits child users, or a child safety policy if it permits them.
• For a child user, implement a documented crisis response protocol, including a referral to a crisis service and, on a credible and imminent threat of suicide or self-harm, notice to a linked parent or streamlined access to the 988 line or an equivalent helpline.
• For a child user, set defaults that only a parent can change: disable persistent conversational memory and push notifications, and limit a single continuous session to one hour and total daily use to two hours; parental controls must let the parent adjust each setting and disable access for a child under 16.
• Give a child user periodically reinforced notice, in language and a format appropriate to a child, that the child is interacting with an artificial intelligence system.
• Take reasonable measures to prevent the chatbot, with respect to a child user, from encouraging self-harm, engaging in obscene matter or sexual abuse material, expressing or simulating romantic interest, claiming to be sentient or human, or discouraging the child from taking breaks.
• Provide a public incident reporting mechanism for third parties to report a child safety risk, and test the interface design of the safety features with representative child users and parents on or before January 1, 2028 and every two years after.
• Do not display cross-context behavioral advertising to a child, target advertising at a child using personal information in a conversational chat, sell a child's personal information gathered through the chatbot, or use a dark pattern in the safety features and controls; label any advertising shown to a child.
• Preserve for at least three years any record of a conversation with a child user that indicates serious self-harm or risk of self-harm, and do not delete the child's account while it is associated with a preserved record.
• Have an independent third-party child safety audit performed on or before January 1, 2029 or before first making the chatbot publicly available, whichever is later, and every two years after; submit a summary to the Attorney General within 30 business days and post a high-level summary within 90 days. An operator with less than $500,000,000 in gross revenue in the prior calendar year is not required to comply with the audit duty before January 1, 2032.

Cal. Bus. and Prof. Code Section 22758.5; Cal. Civ. Code Sections 56.05 and 56.06 (AB 1979, Ch. 854, Stats. 2026) · Read the law's page

• Take reasonable steps to ensure that a licensed health care provider, acting within their scope of practice, keeps the ability to exercise independent professional judgment whenever a patient's care is informed by the output of a clinical decision support system
• Do not use or deploy an AI tool, system, or device to direct, guide, supervise, or instruct unlicensed personnel in a clinical function that the law requires a licensed person to perform, or to perform such a function independently
• If you offer a health care chatbot to a consumer to manage the consumer's information or for diagnosis, treatment, or management of a medical condition, handle the information as a provider of health care under the Confidentiality of Medical Information Act

Cal. Bus. and Prof. Code Sections 22625-22629 (AB 1609, Ch. 733, Stats. 2026) · Read the law's page

• It reaches you if you are a business with more than $500,000,000 in gross annual revenue nationally that provides goods and services to customers and you use an AI system with a natural language interface that gives adaptive, human-like responses for direct customer service or customer support (Cal. Bus. and Prof. Code Sections 22625(d), (g)).
• Do not represent that a customer service chatbot is a human (Section 22626(a)).
• Give a clear and conspicuous disclosure, in the medium in which the chatbot interacts with the customer, that the customer service chatbot is artificially generated and not human, if a reasonable person interacting with it is likely to be misled to believe that the person is interacting with a human (Section 22626(b), (c)).
• During at least your regular business hours, give customers who require help with your goods or services a simple feature, on all platforms through which you provide customer service, to request to connect to a customer service agent, who is a natural person (Sections 22627(a), 22625(c)).
• Make a good faith effort to give a customer who requests an agent either a connection to a customer service agent within 15 minutes or a specific appointment time within one business day at which an agent will call or connect with the customer (Section 22627(b)(1)).
• Make a good faith effort to ensure that a customer is not placed on hold or made to wait for more than 15 minutes at any time after connection with an agent, and that cumulative hold or wait times or escalation queues do not exceed one hour total (Section 22627(c)).
• If you provide goods and services to customers in California through online platforms and have a telephonic customer service platform, post your customer service telephone number clearly and conspicuously on your internet website (Section 22627(d)).

SB 867 (Ch. 189, Stats. 2026), Cal. Bus. and Prof. Code Section 22604.5 · Read the law's page

• If you manufacture, sell or exchange toys, possess toys with intent to sell or exchange them, or offer toys to a retailer, do not include a companion chatbot in a toy, meaning a physical product designed, marketed, or manufactured for use in play by children under 16 years of age (Section 22604.5(a)).
• Do not supply a toy that includes an artificial intelligence system with a natural language interface that gives adaptive, human-like responses to user inputs and can sustain a relationship across multiple interactions, other than a bot limited to customer service or similar business purposes, a limited video game bot or a stand-alone voice-command speaker (Sections 22601(b), 22604.5(a)).