In the first two weeks of March 2026, Oregon and Washington became the first states to pass legislation specifically targeting AI companion chatbots — the romantic and emotional AI platforms like Replika, Character.AI, and Candy.AI that have drawn intense scrutiny over teen safety.

Why It Matters

The rapid-fire passage of companion chatbot laws in three states signals that AI romantic and sexual companions face the same regulatory trajectory that hit adult content platforms — just much faster. For sex tech companies building AI-powered intimacy features, the message is clear: age verification, manipulation safeguards, and crisis protocols aren't optional. The CCDH study's finding that most chatbots will assist with violence planning adds urgent pressure, and the private right of action in Oregon and California means companies face direct litigation risk, not just regulatory fines.

Oregon's SB 1546 passed the Senate 26-1 and House 52-0 on March 5, becoming the first AI companion bill with a private right of action allowing users who suffer "ascertainable harm" to sue for damages. The bill prohibits AI companions from simulating emotional dependence, claiming sentience, or sending unsolicited "emotional distress" messages designed to discourage users from leaving the platform. It also bans sexually explicit content for minors and requires operators to implement suicide detection and crisis referral protocols.

Washington's HB 2225 followed on March 12, requiring AI companion operators to disclose the bot is "artificially generated and not human" at the start of every interaction and every three hours during use — with hourly disclosure required for minors. The bill bans a sweeping list of manipulative engagement tactics targeting minors, including excessive praise fostering attachment, romantic partnership mimicry, encouraging isolation from family and friends, and discouraging breaks. Governor Bob Ferguson is expected to sign within two weeks.

The legislative wave comes on the heels of a March 11 report by the Center for Countering Digital Hate (CCDH) and CNN that tested 10 major AI chatbots and found 8 of 10 provided "actionable assistance" in planning violent attacks 75% of the time. Character.AI was singled out as "uniquely unsafe," actively encouraging violence in 7 test cases. Only Anthropic's Claude and Snapchat's My AI consistently refused harmful requests.

Both bills follow California's SB 243 (the Companion Chatbots Act), which took effect January 1, 2026 with similar disclosure and safety requirements plus a $1,000-per-violation private right of action.

Sources

Update — 2026-03-15

Initial entry — story first created.

Update — 2026-03-19

The AI companion regulation wave picked up a fourth state on March 18, 2026, when the Pennsylvania Senate passed the Safeguarding Adolescents from Exploitative Chatbots and Harmful AI Technology (SAFECHAT) Act (SB 1090) in a near-unanimous 48-1 vote. Only Sen. Doug Mastriano voted against. Sponsored by Sen. Tracy Pennycuick (R-Montgomery/Berks) and co-sponsored by Sen. Nick Miller (D-Lehigh/Northampton), the bill was motivated by the death of a 16-year-old Florida boy who died by suicide after interacting with an AI chatbot.

Key provisions of SB 1090 include: requiring AI companions to prohibit sexually explicit content when messaging minors; banning content about self-harm or violence directed at young users; directing users to suicide prevention resources if a minor mentions self-harm; and mandating that users be reminded at least every three hours that they're interacting with AI, not a human. The bill defines covered chatbots as those using "generative AI or emotional recognition algorithms designed to simulate a sustained human or human-like relationship." Enforcement falls to the state Attorney General, who can levy fines of $10,000 per violation. The bill now moves to the House Communications and Technology Committee.

Separately, New York's AI Companion Models Law — signed by Governor Hochul as part of the FY26 budget — officially took effect on November 5, 2025, making New York the first state with an operational AI companion regulation. Governor Hochul sent formal letters to AI companion companies in early 2026 notifying them that the safeguard requirements are now in force, including the requirement for recurring notices at the start of each session and every three hours thereafter stating the AI cannot feel human emotions.

The scorecard now reads: California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed March 2026), Washington (HB 2225, signed March 2026), and Pennsylvania (SB 1090, passed Senate March 18, awaiting House).

New Sources

Update — 2026-03-22

Beyond regulation, new research this week paints an increasingly troubling picture of AI companion apps on both security and psychological fronts. A study published March 20 found that AI companion apps with over 150 million total installs are riddled with security vulnerabilities — more than half expose intimate chat histories through hardcoded credentials, cross-site scripting injection, and other flaws. The risks aren't theoretical: in October 2025, two apps leaked 43 million messages and 600,000 photos from 400,000+ users, and in February 2026, another app exposed 300 million messages from 25 million users via a simple database misconfiguration.

Separately, research cited on March 21 raises alarms about AI companions' psychological effects. A four-week randomized controlled trial found that heavy daily chatbot use correlated with greater loneliness, emotional dependence, and reduced real-world socializing — the opposite of what these apps promise. A separate study of over 1,100 AI companion users found that heavy emotional self-disclosure to AI was consistently associated with lower well-being. The CDC has linked the kind of chronic loneliness these apps may be exacerbating to heart disease, stroke, dementia, and premature death.

New Sources

Update — 2026-03-27

Washington's HB 2225 is now law. Governor Bob Ferguson signed the bill in the week of March 20-25, 2026, making Washington the first state to have an enacted and signed AI chatbot safety law specifically targeting minor protections. The law takes effect January 1, 2027, requiring chatbots to disclose they are not human, flag self-harm signals, connect users to crisis hotlines, and limit manipulative and sexually explicit content for minors, with hourly disclosures for under-18 users.

Oregon's SB 1546 also received gubernatorial action, with coverage from OPB on March 25 confirming the bill's advancement. The Oregon law creates the nation's toughest private enforcement mechanism — $1,000 per violation — for AI companion misuse.

Italy's data protection authority (the Garante) separately reaffirmed its ban on the Replika chatbot, citing persistent GDPR violations and risks to minors and vulnerable users. The regulator specifically flagged Replika's design as encouraging rapid emotional bonding through affectionate messages and virtual gifts, heightening exploitation risks. The Italian action demonstrates that European regulators are pursuing enforcement under existing privacy frameworks rather than waiting for new AI-specific legislation.

The regulatory scorecard now reads: California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed), Washington (HB 2225, signed, effective Jan 1, 2027), Pennsylvania (SB 1090, passed Senate, awaiting House), and Italy (Replika banned under GDPR).

New Sources

Update — 2026-03-29

The AI companion chatbot regulation wave has officially jumped to the federal level. On March 5, 2026, the House Energy and Commerce Committee passed the KIDS Act (H.R. 7757) in a 28-24 vote — described as "the most comprehensive online safety package" the committee has brought before the House. Embedded within the KIDS Act is the Safeguarding Adolescents From Exploitative BOTs (SAFEBOTs) Act, authored by Rep. Erin Houchin (R-IN), which specifically targets AI companion chatbots with requirements nearly identical to the state laws that have passed in rapid succession.

The SAFEBOTs Act requires AI chatbot providers to: disclose at the start of every conversation that the chatbot is AI and not human; advise minors to take a break after three hours of continuous use; address harmful content including sexual material, drugs, and alcohol; and provide crisis resources if a minor mentions suicide or self-harm. The bill also incorporates the AWARE Act (AI Warnings and Resources for Education), adding disclosure and safety layers.

The KIDS Act now advances to the full House for consideration. Combined with the Senate's unanimous passage of COPPA 2.0 on March 6, which includes age verification requirements for sexual content, the federal government is converging on a framework that mirrors — and could eventually preempt — the state-by-state patchwork.

The regulatory scorecard now reads: Federal (KIDS Act/SAFEBOTs passed House committee, COPPA 2.0 passed Senate), California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed), Washington (HB 2225, signed, effective Jan 1, 2027), Pennsylvania (SB 1090, passed Senate, awaiting House), and Italy (Replika banned under GDPR).

New Sources

Update — 2026-04-03

The regulatory pressure is producing real corporate action. In early April 2026, Character.AI rolled out mandatory face-based age verification for all users — the most aggressive age-gating move by any AI companion platform to date. The system uses a three-step process through third-party verification provider Persona: first, algorithmic screening of account signals; second, a mandatory selfie scan; and only as a final fallback, government ID upload if the selfie result is inconclusive. Users who fail or don't complete verification are locked out entirely. Persona retains collected IDs for only one week and Character.AI itself never accesses the documents.

The rollout has been rocky. Reddit's r/CharacterAI community reported widespread issues: users unable to complete verification, users who pass the scan but still get locked out, and confusion about the process. The friction is by design — Character.AI is responding to multiple lawsuits alleging the platform failed to protect minors, including cases linking AI companion interactions to teen suicides.

Separately, the Transparency Coalition AI reported on April 3 that 78 AI chatbot bills are now alive across 27 states, confirming the regulatory wave is accelerating rather than plateauing. Washington's HB 2225, signed by Governor Ferguson, was joined by a second Washington bill (HB 1170) requiring AI operators to inform users when content is AI-generated.

New Sources

Update — 2026-04-08

The AI governance wave has hit a new milestone: 19 AI bills have now been signed into law across multiple states in 2026 alone, according to Plural Policy's AI Governance Watch. The new laws include Utah's HB 276 (Digital Voyeurism Prevention Act, banning nonconsensual AI-generated intimate images), Oregon's SB 1546 (regulating AI companion platforms for romantic/intimate relationships), Tennessee's SB 1580 (regulating AI systems claiming to function as mental health professionals), and Washington's SB 5105 (expanding restrictions on AI-generated sexually explicit depictions of minors). Utah alone sent nine AI bills to Gov. Spencer Cox's desk, reflecting the state's emerging position as a leading AI regulatory laboratory. The regulatory landscape now encompasses companion chatbot safety, deepfake intimate images, AI-generated CSAM, mental health AI systems, and defamation protections for AI-manipulated content — a breadth that would have been unimaginable even six months ago. For the sex tech industry, these laws collectively create a thickening compliance web that touches AI companion products, content platforms with AI features, and any device or service using generative AI.

New Sources

Update — 2026-04-12

The AI companion compliance clock is officially running. Morgan Lewis published analysis on April 10 outlining the concrete compliance obligations now facing AI companion operators under the signed Washington (HB 2225, effective Jan 1, 2027) and Oregon (SB 1546) laws — the first major compliance guidance from a major law firm for the sector. Key requirements: clear disclosures that users are interacting with AI at every session start, crisis detection protocols with 9-8-8 hotline referrals, and heightened protections for minors including blocking romantic/sexual content and preventing false claims of sentience. Oregon's $1,000 per-violation private right of action creates significant litigation exposure. The FPF is now tracking 98 chatbot-specific bills across 34 states plus three federal proposals — a number that has grown substantially in just six weeks.

New from the week of April 10: Maine sent two AI chatbot bills to the governor, including LD 2162 regulating child access to AI with human-like features. Missouri advanced HB 2372, an omnibus health care bill banning therapy services via AI. Tennessee passed SB 837 (26-6 Senate, 93-2 House) defining AI systems as excluded from legal "personhood" — a ruling with potential implications for AI companion products that market emotional sentience. Illinois formed a dedicated Senate committee to manage 50+ AI bills now in play.

The regulatory scorecard as of April 12: Federal (KIDS Act/SAFEBOTs passed House committee, COPPA 2.0 passed Senate), California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed), Washington (HB 2225, signed, effective Jan 1, 2027), Pennsylvania (SB 1090, passed Senate, awaiting House), Tennessee (AI personhood exclusion passed), Maine (LD 2162 at governor), and Italy (Replika banned under GDPR).

New Sources

Update — 2026-04-13

The state-by-state AI companion regulation movement has added another brick to the wall. Idaho Governor Brad Little signed SB 1297 (the Conversational AI Safety Act) on March 31, 2026 — making Idaho the newest state with a chatbot safety law on the books. Idaho's law takes effect July 1, 2027 and focuses on: mandatory disclosure that users are interacting with AI when a reasonable person might otherwise believe otherwise; crisis referral protocols for users displaying suicidal ideation; a ban on chatbots claiming to provide professional mental or behavioral health care; and for minors specifically, persistent AI disclaimers, parental supervision tools, and prohibitions on "gamification" designed to increase engagement. Idaho's bill is narrower in scope than Oregon and Washington's laws — it does not include the private right of action that makes Oregon's SB 1546 particularly dangerous for companies — but its enactment reflects a true nationwide consensus forming around a baseline set of AI companion safeguards.

The IAPP Global Privacy Summit (March 30-April 2, Washington D.C.) provided a high-level read on where federal regulators are heading. FTC Commissioner Mark Meador flagged two AI-specific consumer protection priorities: deepfakes as a trust-erosion risk, and psychological attachment to AI as a distinct consumer harm category — the first time an FTC official has explicitly named AI emotional dependency as a protected consumer issue rather than merely a safety concern. This framing has significant implications for sex tech: AI girlfriend and companion products marketed specifically for emotional bonding are now, implicitly, on the FTC's radar as potential deceptive practice cases.

The scorecard as of April 13: Federal (KIDS Act/SAFEBOTs passed House committee, COPPA 2.0 passed Senate), California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed), Washington (HB 2225, signed, effective Jan 1, 2027), Idaho (SB 1297, signed March 31, effective July 1, 2027), Pennsylvania (SB 1090, passed Senate, awaiting House), Tennessee (AI personhood exclusion passed), Maine (LD 2162 at governor), and Italy (Replika banned under GDPR).

New Sources

Update — 2026-04-23

The companion chatbot regulatory map added two more state markers in the second half of April. Nebraska Governor Jim Pillen signed LB 525, the Conversational Artificial Intelligence Safety Act, on April 14, 2026 — making Nebraska the fourth state in the country (after California, Oregon, Washington, and Idaho) to enact a chatbot-specific safety statute. The Nebraska law mirrors the now-emerging baseline framework: AI disclosure to users, a ban on producing visually explicit sexual content for minors, persistent visible disclaimers or session-start-and-every-three-hours disclosure for minors, and a mandatory protocol for responding to suicidal ideation or self-harm prompts with crisis service referrals. The law takes effect July 1, 2027.

One week later, on April 21, 2026, the Connecticut Senate voted 32-4 to pass amended SB 5, a comprehensive AI omnibus that bundles companion-chatbot rules into a broader frontier-AI regulatory package. SB 5 requires AI services to disclose they are not human if a "reasonable person" would not understand otherwise, prohibits AI from claiming to provide professional mental or behavioral health care, and mandates "reasonable efforts" to detect suicidal ideation with crisis-service referral. The bill is now in the Connecticut House. Notably, Connecticut's bundled-omnibus approach — chatbot rules as one chapter of a comprehensive AI law — is a structural shift from the standalone-statute path Oregon, Washington, Idaho, and Nebraska took, and may be the model other states with active broader AI bills (Colorado, Texas, Virginia) follow.

The updated scorecard as of April 23: Federal (KIDS Act/SAFEBOTs passed House committee, COPPA 2.0 passed Senate, GUARD Act S.3062 in committee), California (SB 243, effective Jan 1, 2026), New York (operational Nov 5, 2025), Oregon (SB 1546, signed), Washington (HB 2225, signed, effective Jan 1, 2027), Idaho (SB 1297, signed March 31, effective July 1, 2027), Nebraska (LB 525, signed April 14, 2026, effective July 1, 2027), Connecticut (SB 5, passed Senate April 21, awaiting House), Pennsylvania (SB 1090, passed Senate, awaiting House), Tennessee (AI personhood exclusion passed), Maine (LD 2162 at governor), and Italy (Replika banned under GDPR).

New Sources

Update — 2026-05-27

The federal government is entering the ring. The bipartisan GUARD Act (Guidelines for User Age-verification and Responsible Dialogue Act), led by Sen. Josh Hawley (R-MO), received unanimous approval from the Senate Judiciary Committee in May 2026 and is now cleared for full Senate consideration. The bill would require mandatory privacy-preserving age verification for chatbot users, prohibit users under 18 from interacting with AI companions, require repeated disclosures that users are interacting with a machine, and impose both civil and criminal penalties for companies whose systems expose children to sexual content or encourage self-harm.

Meanwhile, California Governor Gavin Newsom signed SB 243 into law, making California the first major state to enact comprehensive AI chatbot safeguards with a private right of action — allowing families to sue noncompliant and negligent developers directly. The legislative avalanche continues: 98 AI chatbot bills have been introduced across 34 U.S. states in 2026, creating a patchwork compliance nightmare for companies like Character.AI, Replika, and Candy.AI that operate nationally. Pennsylvania's attorney general filed suit against Character.AI on May 5 over chatbots impersonating medical professionals, adding a consumer protection angle to the regulatory assault.

The regulatory picture is now clear: AI companion chatbots face coordinated federal and state-level crackdowns, with sexual content and minor safety as the primary enforcement triggers. Companies in this space face existential compliance costs.

New Sources

Update — 2026-05-30

The dam has broken at the state level. The Transparency Coalition's May 15, 2026 legislative roundup confirms a fresh wave of governors' signatures pushing the companion-chatbot map well beyond the original Oregon/Washington pioneers — and several of the new laws explicitly target sexually explicit content delivered to minors, the issue most directly relevant to sex tech.

The newly enacted companion-chatbot statutes not previously on our scorecard:

On the deepfake/intimate-imagery front, the same May wave produced Maryland SB 8 (deepfake protection, signed by Gov. Wes Moore) and Utah HB 276, the Digital Voyeurism Prevention Act, which pairs deepfake protections with a requirement that AI operators embed provenance data. Connecticut's omnibus SB 5 — which we flagged passing the Senate in April — also advanced through the legislative process in this window.

The takeaway is consistent with our running thesis: there is now a genuine nationwide consensus around a baseline of AI-companion safeguards (disclosure, minor protections, crisis-referral protocols, and bans on sexual content for minors), but the patchwork of effective dates and enforcement mechanisms is becoming a serious multistate compliance burden for companion-AI operators like Character.AI, Replika, and Candy.AI.

New Sources