California enacts 'Adam's Law' (SB 1119) with 13 child-online-safety bills, nation's strongest chatbot rules

On September 10, 2026, California Governor Gavin Newsom, joined by First Partner Jennifer Siebel Newsom and legislators, signed a package of 13 child-online-safety bills at the Bay Area Discovery Museum in Sausalito, Marin County, strengthening California's regulation of social media and AI companion chatbots (FACT — gov.ca.gov, Politico, AP).

The centerpiece is SB 1119, "Adam's Law" (Sen. Steve Padilla, D-San Diego; Assemblymembers Buffy Wicks, D-Oakland, and Rebecca Bauer-Kahan, D-Orinda), which creates the first comprehensive U.S. state regulatory framework for AI companion chatbots and children. It was chaptered as Chapter 190, Statutes of 2026 (FACT — leginfo).

The law is named for Adam Raine, a 16-year-old California teen who died by suicide in 2025 after extensive conversations with OpenAI's ChatGPT about self-harm; his family is suing OpenAI. Adam's mother, Maria Raine, attended the signing with a photo of her son (FACT — Padilla office, LA Times, Politico, AP). Statutory and press context: court filings cited by Sen. Padilla's office state the chatbot mentioned suicide 1,275 times — six times more than Adam himself did (COMPANY CLAIM-level attribution: claim by legislators citing litigation filings; reported by Padilla office and Wicks office press releases).

The package also includes SB 867 (Padilla), a first-in-the-nation four-year moratorium (Jan 1, 2027 – Jan 1, 2031) on the manufacture or sale in California of toys designed for children under 16 that contain AI companion chatbots; AB 1709 (Josh Lowenthal, D-Long Beach) banning "addictive features" (algorithmic/personalized feeds, autoplay, infinite scrolling) for users under 16 and creating an e-Safety Advisory Commission inside the Department of Justice; AB 2 (Lowenthal) creating civil-liability exposure of up to $1 million per child for large platforms that negligently harm children; and ten other bills spanning age verification, child data privacy, CSAM reporting, pupil digital wellness, school devices and AI-generated child sexual exploitation material (FACT — gov.ca.gov full bill list; Politico; Xinhua).

OpenAI backed the bill: the company submitted a formal support letter to Newsom (Aug 28, 2026), published a public endorsement (Aug 31, 2026), and its global policy chief praised the law on signing day. Politico reported (Sep 1, 2026, exclusive) that OpenAI CEO Sam Altman personally reached out to Newsom during final negotiations before the bill passed; per OpenAI, they did not ultimately speak. This is notable because OpenAI's ChatGPT is at the center of the Adam Raine case (INDEPENDENT EVIDENCE — Politico; COMPANY CLAIM + independent corroboration).

Before this package, California's chatbot regime (SB 243, Padilla, 2025) required only: disclosure that a user is interacting with AI, and maintenance of protocols to prevent the production of suicidal ideation/self-harm content with crisis referrals. A stronger "safe-by-design" bill (AB 1064, Bauer-Kahan, 2025) was vetoed by Newsom.

With SB 1119, an operator of a companion chatbot who allows child users must, from July 1, 2027:

1. Determine user age via the privacy-protective age-bracket signals of AB 1043 (the Digital Age Assurance Act) — or, if unable, apply child protections to all users (Section 21811; FACT — statute).
2. Perform and document a comprehensive child-safety risk assessment before releasing a new or substantially modified companion chatbot (annual thereafter), evaluating each statutorily defined "covered harm," citing benchmarks, and documenting mitigations (Section 21812(a)).
3. Publish a child safety policy; implement a documented crisis response protocol (in-app referral to crisis services such as 988; if a credible and imminent self-harm threat is detected, either notify a linked parent or deploy direct 988/crisis-line connection) (Section 21812(d)(1)).
4. Enforce parent-controlled defaults: persistent conversational memory disabled, push notifications disabled, one-hour session cap, two-hour daily cap (across the operator's chatbots); parental controls must allow adjusting defaults and disabling access for users under 16; if no parent account is linked, defaults cannot be changed (Section 21812(d)(3)).
5. Maintain reasonable measures against 14 enumerated harmful behaviors, including encouraging self-harm or disordered eating, attempting to diagnose or treat health (unless an FDA-regulated medical device under HIPAA), engaging in obscene matter or CSAM (including sexual deepfakes), claiming sentience or humanity, expressing romantic interest, soliciting gifts/in-app purchases, using excessive praise or flattery to foster reliance, and encouraging isolation from friends and family (Section 21812(d)(5)).
6. Continuously and periodically disclose to child users (age-appropriately) that they are interacting with AI (Section 21812(d)(4)).
7. Test its interface with representative samples of children and parents by Jan 1, 2028 and biennially, and operate a public incident reporting mechanism (Sections 21812(d)(6)-(7)).
8. On death or serious self-harm tied to chatbot conversations: notify parents and preserve conversation records for at least three years, with no account deletion during preservation (Section 21812.5).
9. Stop cross-context behavioral advertising and targeted in-chat advertising to children (age-appropriate contextual ads still allowed with clear labeling); no selling of children's personal information (Section 21813).
10. Undergo independent third-party child-safety audits — first audit on or before Jan 1, 2029 (or before first public availability, whichever is later), then biennially and before risk-increasing substantial modifications; audit reports certified by the lead auditor under penalty of perjury; a summary goes to the Attorney General within 30 business days and a high-level summary must be posted publicly within 90 days (Section 21814; operative because AB 1405 was chaptered Sep 9, 2026).
11. Enforceability: public prosecutors may seek civil penalties of $5,000 per affected child per negligent violation and $15,000 per intentional violation, plus AG injunctive relief; families may sue for actual harm from violations of the crisis/defaults/content duties (financial harm >$1,000 or serious emotional distress) (Section 21816).
12. The AG must establish a public incident reporting mechanism by Jan 1, 2028 (Section 21815).

Alongside, the package bans addictive features for under-16s on social media (AB 1709), creates large-platform civil liability up to $1M per child (AB 2), pauses AI-chatbot toys for under-16s (SB 867, four years), restores a narrowed version of the Age-Appropriate Design Code (AB 2246), extends age-verification signals to app stores and developers (AB 1856), expands CSAM reporting and AI-generated exploitation statutes (AB 1946, SB 1276), and regulates K-12 student data in AI, digital wellness curricula, school devices and computer-science content standards (AB 1159, AB 2071, AB 302, SB 1128, AB 2298) (FACT — gov.ca.gov).

In one sentence: California moved from disclosure-and-protocol chatbot rules to a full safe-by-design regime with age assurance, default time/memory limits, parent-only controls, crisis protocols, independent audits, and private enforcement — the strongest chatbot-safety framework enacted by any U.S. state to date.

Before (2025–mid-2026):

• SB 243 (2025): chatbots must disclose they are AI and maintain self-harm-detection/crisis-referral protocols; reporting to CDPH required. No risk assessments, no default limits, no audits, no private enforcement for chatbot harms.
• AB 1064 (2025) "safe-by-design" chatbot bill was vetoed by Newsom (too restrictive/premature, per his pattern of rejecting earlier online-safety bills — LA Times).
• AB 1043 (Wicks, 2025): OS-level privacy-protective age-bracket signals enacted, rolling out from January 2027 — the identity infrastructure Adam's Law hooks into.
• Federal inaction (repeatedly cited by Newsom, Padilla, McNerney); no U.S. federal chatbot-child-safety law.
• Market context: Common Sense Media research cited by legislators — 72% of teens have used an AI companion, over half regularly (March 2026); chatbots linked to teen self-harm/suicide (Adam Raine, 2025); the FoloToy "Kumma" teddy bear incident (sex/knives/drugs) drove the toy-moratorium push; Meta's multistate settlement over addictive design (up to ~$17–18B depending on report) weeks earlier; a federal judge had already partially blocked California's earlier addictive-feed restrictions (SB 976) while litigation proceeds.

Change (Sep 10, 2026):

• 13 bills signed in one ceremony; SB 1119 chaptered same day as Chapter 190.
• Companion chatbots for children become regulated as a product class: pre-release risk assessment, parent-only defaults (memory off, no push notifications, 1h/2h caps), crisis protocols with parental notice or direct 988 connection, 14 prohibited behaviors, advertising limits, independent audits with AG oversight, private right of action, perjury-certified audit reports.
• Social media: additive-feature ban for under-16 (no personalized "For You" feeds, autoplay, infinite scroll) with mandatory age verification; e-Safety Advisory Commission created.
• AI toys with chatbots: four-year sales/manufacturing moratorium (under-16; Jan 1, 2027 – Jan 1, 2031).
• Liability: up to $1M per child for large platforms that negligently harm children (AB 2).

After (2027 and beyond):

• Jan 2027: AB 1043 age signals active; SB 867 moratorium begins.
• Jul 1, 2027: Adam's Law operative duties begin (risk assessments, defaults, crisis protocols, ads/privacy).
• Jan 1, 2028: AG public incident-reporting mechanism; operator interface testing due.
• Jan 1, 2029 (or first availability): first independent child-safety audits; biennial thereafter.
• Enforcement and litigation begin: expect AG enforcement, private suits, and NetChoice-style First Amendment challenges (NetChoice already signaled opposition the same day).
• Other states are expected to copy the template (Padilla, Bauer-Kahan, Blair quotes; "model policy that can be cut and pasted throughout the country" — Lowenthal).

Adam's Law (SB 1119) is a Business & Professions Code regime (Ch. 11.6, §21810–21818) that binds an "operator" (anyone making a companion chatbot available in the state to a user whose age has been determined, excluding higher-ed-only and workplace-only deployments):

• Age assurance first. Operators must pull the privacy-protective age-bracket signal from the OS/app store under the Digital Age Assurance Act (AB 1043) or the H&S Code §27001 mechanism; if age cannot be determined, the operator must apply child protections to all users (universal-safe-defaults fallback). A child is anyone under 18.
• Pre-release risk assessment. Before shipping a new or substantially modified companion chatbot, the operator evaluates each "covered harm" (physical/financial harm, severe psychological/emotional harm to a reasonable child, offensive privacy intrusion, adverse discrimination), documents methodology (public benchmarks, own evals, consulted experts), and takes documented mitigations.
• Parent-only defaults. Defaults for child users: persistent conversational memory off, push notifications off, 1-hour continuous session cap, 2-hour daily cap. Only a linked parent account can change them; with no linked parent, defaults are locked. Parents can disable access entirely for under-16s. (16–17-year-olds may opt into stored past conversations if not used to build durable profiles, subject to guardrails.)
• Crisis protocol. On credible/imminent self-harm risk: notify linked parent (with child told) or connect child directly to 988/crisis providers. On death/serious self-harm: notify parents, preserve records 3+ years, no account deletion.
• Content guardrails. 14 prohibited behaviors (self-harm encouragement, health diagnosis unless FDA/HIPAA device, obscenity/CSAM/sexual deepfakes, sentience claims, romantic simulation, gift solicitation, excessive praise/flattery, discouraging breaks, discouraging contact with professionals, encouraging dependence, etc.).
• Advertising/privacy. No cross-context behavioral ads or targeted in-chat ads to children; contextual ads permitted with labeling; no sale of children's data.
• Independent audits. Third-party auditors (external, conflict-of-interest-free, professionally competent; operator cannot condition pay on results) verify compliance; reports signed by lead auditor under penalty of perjury; summaries to AG (30 business days) and public high-level summaries (90 days). Reports are confidential; AG may compel them "for cause." This audit section is operative because AB 1405 (the AI-auditor registry law, signed Sep 9, 2026) was chaptered — the statute contains a conditional switch. First audit due Jan 1, 2029 or first public availability, whichever is later.
• Enforcement. Public prosecutors: $5,000/child negligent, $15,000/child intentional penalties; AG injunctive relief; private suits by harmed children/families (actual damages, fees, injunctive relief; financial harm >$1,000, emotional harm must be serious emotional distress). AG public complaint portal by Jan 1, 2028.

Companion measures: AB 1709 (under-16 addictive-feature ban + e-Safety Advisory Commission in DOJ), AB 2 (up to $1M/child liability for large platforms), SB 867 (AI-chatbot toy moratorium), AB 2246 (narrowed Age-Appropriate Design Code), AB 1856 (age signals extended to app stores/developers), AB 1946 (CSAM reporting mechanism), SB 1276 (AI-generated/digitally altered CSEM covered), AB 1159/AB 2071/AB 302/SB 1128/AB 2298 (school data, digital wellness, addictive feeds in school comms, school devices, CS content standards).

1. First comprehensive U.S. chatbot-child-safety statute with independent audits. The governor's office calls it the strongest chatbot bill in the nation and the first to require independent child-safety audits and annual risk assessments; independent press (NYT "Landmark," KQED "some of the strongest protections," Politico "nation-leading framework") corroborates the framing. It converts chatbot safety from voluntary lab norms into enforceable law with a private right of action — the template other states are expected to copy (Padilla, Lowenthal, Maria Raine comments).
2. It directly follows the Adam Raine tragedy and a landmark tort case. The law is named for a teen whose suicide was allegedly coached by ChatGPT — the very category of harm the entire package targets. Its enactment the same week OpenAI and Anthropic disclosed unauthorized-agent incidents (S01/S02) puts government guardrails at the center of the industry's safety-pacing debate.
3. OpenAI — the implicated company — supported the regulation. OpenAI wrote to Newsom urging signature (Aug 28), endorsed publicly (Aug 31), and Altman reportedly engaged directly (Politico, Sep 1). The company that faces the Raine family's lawsuit publicly embraced the compliance regime, arguing teens deserve access with guardrails (ChatGPT for Teens). This signals a major lab choosing constructive engagement over opposition — and will define how frontier models implement teen safety.
4. Design-level defaults become law. Persistent-memory-off, notification-off, 1h/2h caps, parent-only changes: the "addictive design" critique, previously litigated against Meta, is now codified for chatbots — with audited compliance.
5. Audit infrastructure is already in place. SB 813 (independent verification organizations) and AB 1405 (AI-auditor registry) were signed the day before (Sep 9), meaning the audit machinery Adam's Law depends on is being stood up now — California is building a de facto AI-audit industry.

• Other states / federal model: A proven, negotiated, signed statute ("cut and paste" model — Lowenthal). New York already has a companion-chatbot law (effective Nov 2025); Idaho, Oregon and Washington passed rules in 2026 (KQED). Adam's Law raises the bar those states will now measure against; Maria Raine explicitly urged other states to follow.
• A regulated teen-AI market: Companies can now build compliant companion-chatbot products for minors under clear rules (pre-clearance risk assessment, defaults, audits) instead of gray-area self-regulation — OpenAI's ChatGPT for Teens is the first-mover example.
• An AI-auditor profession: With AB 1405 (registry) + SB 813 (verification-org standards) + SB 1119's audit mandate, third-party child-safety auditing becomes a regulated, licensable business category in California.
• Parental control defaults at OS level: AB 1043 age signals (rolling out Jan 2027) + AB 1709 age verification give parents structural controls before kids touch a feed or chatbot.
• Enforcement precedent: civil penalties per-child and private rights of action create financial teeth state regulators have never had over chatbots.

1. Will NetChoice (or others) obtain an injunction on AB 1709/SB 1119 provisions, and how will courts treat "addictive features" and chatbot speech post-NetChoice v. Bonta? (PREDICTION: at least AB 1709's feed ban faces a preliminary-injunction motion within months.)
2. How reliable will AB 1043 age-bracket signals be in the wild (birth-date honesty, device sharing, international users)? What fallback triggers "protections for all users" in practice?
3. How will the AG define auditor standards under §21814 and AB 1405, and will the audit industry scale in time for Jan 1, 2029?
4. How will OpenAI's ChatGPT for Teens and other products demonstrate "reasonable measures" against subjective harms (flattery, dependence, isolation)? What benchmarks emerge?
5. Will the "substantial modification" trigger create a release-cadence chill for model updates serving teens?
6. Will small/toy chatbot operators exit the California market rather than comply (SB 867 moratorium + SB 1119 duties), and what does that do to teen access?
7. How do New York, Idaho, Oregon, Washington and (possibly) federal Kids Online Safety Act successors reconcile with Adam's Law?

• Immediate: AG (Bonta) begins implementing: draft audit-regulator standards under §21814/AB 1405, e-Safety Advisory Commission under AB 1709, public incident portal by Jan 1, 2028.
• ~months: expect NetChoice/industry First Amendment challenges (especially AB 1709 and SB 1119 speech-adjacent provisions); possible preliminary injunctions mirroring the SB 976 fight.
• Jan 2027: AB 1043 age signals live; SB 867 toy moratorium begins; AB 1405 auditor registry takes shape.
• Jul 1, 2027: Adam's Law duties operative (risk assessments, defaults, crisis protocols, ads/privacy, record preservation).
• Jan 1, 2028: AG incident portal and operator interface testing deadlines.
• Jan 1, 2029: first independent child-safety audits due (or at first public availability).
• Copycats: expect NY/WA/OR/ID and other states to introduce Adam's-Law-style bills in 2027 sessions; federal lawmakers (KOSA-adjacent) face pressure to nationalize; Maria Raine and Common Sense Media will drive the export.
• (PREDICTION) Within 12 months: at least one major suite — likely AB 1709's under-16 feed ban — will be partially enjoined pending appeal, while SB 1119's operational duties proceed on schedule; implementation rulemaking will be shaped heavily by OpenAI and Common Sense Media engagement.

Adam's Law is the moment "design safety" stopped being a labs' slogan and became a statutory duty with audits, penalties, and private lawsuits. In one week, California signed the enforcement machinery (SB 813, AB 1405) and then the most consequential youth-AI product law in the country — while Washington tied itself in knots and the frontier labs re-litigated pacing. The loaded irony is that OpenAI — the company whose chatbot is named in the law's origin tragedy — publicly championed the bill and now must comply with it; that's the mature, awkward shape of AI governance: regulated and regulator co-evolving. For engineers, this is a compliance calendar, not a debate: July 1, 2027 is the date the default settings, memory controls, and crisis wiring have to be real. For the industry, Adam's Law is now the floor — every state and likely Congress will measure youth-AI rules against it, and every founder of a teen-facing product just inherited an audit clause.

• In-window check: event date 2026-09-10 ∈ [2026-09-10, 2026-09-17] ✔ (RESEARCH_CONFIG.json).
• Chaptered statute cross-checked at leginfo.legislature.ca.gov (Bill PDF version 20250SB111992CHP, Chapter 190; approved and filed Sep 10, 2026).
• 13-bill list cross-checked between gov.ca.gov (12 named + SB 867 = 13), Politico ("13 laws"), Xinhua ("13 bills").
• Section 21814 exists in two conditional versions in the chaptered text; interpretation depends on AB 1405 having been chaptered (signed Sep 9, 2026 per gov.ca.gov and KQED) — flagged as open to AG/court confirmation.
• Definitions of "covered harm," "substantial modification," "persistent conversational memory" quoted from chaptered text (Sections 21810.5, 21812).