Law / United States / California

SB 1119 (2026), Adam's Law: companion chatbots and children's safety

Cal. Bus. & Prof. Code §§ 21810-21818

An age-appropriate design code rule binding private bodies.

Audit expectation

periodic

Who audits it

Independent third party

Where the report goes

Filed with regulator, Published summary, Kept, Produced on request

As of 16 October 2026.

What it requires

• Applies to an operator, a person who makes a companion chatbot available to a user in the state, other than a postsecondary educational institution that makes one available exclusively for educational settings and an entity that makes one available exclusively to its personnel for workplace use.
• Determine the age of each user under the Digital Age Assurance Act; if that cannot be done, rely on the age determination made under Health and Safety Code Section 27001; otherwise apply the child protections of Sections 21812(d) and 21813 to all users.no control in the NIST Privacy Framework
• Before making a new or substantially modified companion chatbot available, perform and document a comprehensive risk assessment of covered harms to child users, and take and document measures that reasonably mitigate the child safety risks it identifies.NIST Privacy FrameworkID.RA-P4
• Publish on the operator's website a description of how it complies with the age assurance requirements if it prohibits child users, or a child safety policy if it permits them.no control in the NIST Privacy Framework
• For a child user, implement a documented crisis response protocol, including a referral to a crisis service and, on a credible and imminent threat of suicide or self-harm, notice to a linked parent or streamlined access to the 988 line or an equivalent helpline.no control in the NIST Privacy Framework
• For a child user, set defaults that only a parent can change: disable persistent conversational memory and push notifications, and limit a single continuous session to one hour and total daily use to two hours; parental controls must let the parent adjust each setting and disable access for a child under 16.NIST Privacy FrameworkCT.PO-P3
• Give a child user periodically reinforced notice, in language and a format appropriate to a child, that the child is interacting with an artificial intelligence system.no control in the NIST Privacy Framework
• Take reasonable measures to prevent the chatbot, with respect to a child user, from encouraging self-harm, engaging in obscene matter or sexual abuse material, expressing or simulating romantic interest, claiming to be sentient or human, or discouraging the child from taking breaks.no control in the NIST Privacy Framework
• Provide a public incident reporting mechanism for third parties to report a child safety risk, and test the interface design of the safety features with representative child users and parents on or before January 1, 2028 and every two years after.no control in the NIST Privacy Framework
• Do not display cross-context behavioral advertising to a child, target advertising at a child using personal information in a conversational chat, sell a child's personal information gathered through the chatbot, or use a dark pattern in the safety features and controls; label any advertising shown to a child.NIST Privacy FrameworkCT.PO-P1
• Preserve for at least three years any record of a conversation with a child user that indicates serious self-harm or risk of self-harm, and do not delete the child's account while it is associated with a preserved record.NIST Privacy FrameworkCT.PO-P2
• Have an independent third-party child safety audit performed on or before January 1, 2029 or before first making the chatbot publicly available, whichever is later, and every two years after; submit a summary to the Attorney General within 30 business days and post a high-level summary within 90 days. An operator with less than $500,000,000 in gross revenue in the prior calendar year is not required to comply with the audit duty before January 1, 2032.no control in the NIST Privacy Framework

These lines are LexLint's reading of the law's text, as of 16 October 2026.

In the frameworks

NIST Privacy Framework

• ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
• CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
• CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
• CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Who enforces it

What it reaches

When LexLint raises it

When your app profile says your app serves under-18s.

Back to the example  ·  Lint your app