On September 1, 2026, Tech Policy Press published an analysis by DLA Piper's Danny Tobey, Ashley Carr and Michael Atleson mapping all twelve state "companion bot" laws now on the books — the first consolidated read on what AI companion providers actually have to build. Three are already in force: New York, California and Hawaii. Nine more take effect in 2027: Colorado, Connecticut, Georgia, Iowa, Idaho, Nebraska, Oregon, Rhode Island and Washington.

Why It Matters

For anyone building or investing in AI companions — a category where romantic and sexual roleplay is the core retention driver, not an edge case — the compliance surface just became concrete. The four common principles are close enough across states that a single product spec can satisfy most of them, which is the good news. The bad news is in the definitional gaps: a product that's compliant in New York can be out of scope in Georgia and squarely non-compliant in Connecticut, because the states disagree on what a companion bot even is. Colorado's rulemaking is the piece to actually track. Because no other state has issued interpretive guidance on the "reasonable measures" and "technically feasible measures" language, whatever Colorado finalizes will likely become the reference point regulators and courts elsewhere reach for. The factors the AG has proposed — testing, monitoring, remediation, documentation — map almost exactly onto standard AI governance program design, which means companies with real model-evaluation infrastructure will clear the bar and companies shipping a wrapper around someone else's API will not. Note also what these laws do and don't touch. They regulate minors' access, disclosure, and crisis handling. Not one of them meaningfully restricts adult sexual companion content, which remains legal and largely unregulated at the state level. The regulatory pressure on adult AI intimacy continues to come from payment processors and app stores rather than legislatures — a distinction the industry should not confuse with safety.

The scope definitions are where the divergence starts. Most of the laws restrict coverage to bots that exhibit anthropomorphic features and sustain relationships across multiple interactions — the classic AI-girlfriend product. But Colorado, Connecticut, Idaho, Iowa and Nebraska wrote broader language covering any bot that "simulates human conversation and interaction" via text, audio or video, which sweeps in a great deal of software that nobody would call a companion. All except Hawaii carve out chatbots used for business purposes or narrow functions like a video game feature.

The analysis identifies four requirements that now function as a de facto national baseline. First, transparency: all twelve require clear disclosure that the user is talking to an AI, though states differ on whether that's a one-time notice or persistent. Washington goes furthest, barring bots from representing themselves as human to any user, not just minors. Second, heightened minor protections (all but New York and Rhode Island): reasonable measures to block sexually explicit content, prevent engagement-maximizing mechanics like points and rewards, prevent emotional manipulation and dependency including discouraging users from seeking help from adults, and provide parental controls. Most trigger on actual or constructive knowledge that a user is a minor; Colorado and Georgia impose an affirmative duty to use "commercially reasonable" age-estimation methods, with Georgia limiting that duty to features that may generate sexually explicit content.

Third, crisis protocols: all twelve require detection of suicidal ideation or self-harm expressions and referral to crisis resources. Colorado, Georgia and Oregon require escalation procedures for repeated or severe indicators; Oregon specifies "clinical best practices and expertise" for additional intervention when a user keeps expressing ideation after receiving resources. Fourth, professional-representation limits: several prohibit bots from claiming to be mental health professionals — a restriction echoed in at least eight additional state laws aimed specifically at mental-health bots (Nevada, Utah, Illinois, Delaware, Maine, Tennessee, Rhode Island and Vermont). Colorado extends the concept to health care providers, dietitians and attorneys.

Connecticut is the outlier worth watching. Rather than requiring reasonable measures to prevent certain outputs, it forbids offering a companion bot to minors where it is "reasonably foreseeable" that the bot "is capable of" a broad list of harmful interactions — a capability standard rather than a conduct standard, which is a much harder thing to engineer around.

The near-term action is in Colorado. On August 11, the state Attorney General released proposed rules under what is now called the Chatbot Safety Act, addressing the statutory standards requiring "technically feasible measures" to prevent explicit sexual content to minors and "reasonable measures" to prevent responses that simulate emotional dependence or isolation from real-world supports. Sections 11.3 and 11.4 list the factors the AG would weigh: availability and effectiveness of safeguards, and the extent of testing, monitoring, remediation and documentation. Public comments are due October 26.

Sources

Update — 2026-09-02

Initial entry — story first created.

Update — 2026-10-12

Virginia writes its principles, and makes sexual content opt-in by default. On Thursday, October 8, 2026, Virginia's Joint Commission on Technology and Science (JCOTS) accepted a set of chatbot recommendations built on six policy principles to guide bills in the next General Assembly session: mitigate extreme harms for all users, target design features, mandate transparency and accountability, enable user choice and autonomy, enable legislative learning, and engage affected communities. They would only become binding through legislation.

The substance largely matches the four-part baseline in the DLA Piper map above, with one clear difference for this beat. Per The Center Square, romantic or sexual content and excessive agreement with users would be limited by default, and adults could turn on additional features by creating an account. JCOTS executive director Jodi Kuhn described the approach as focusing on features associated with harm while leaving room for user choice. Other recommendations include crisis protocols with published policies, a clear way to report harmful interactions, a ban on bots presenting as licensed professionals, disclosure that the bot is not human, break reminders every two hours, and easy account deletion. For minors, they call for parent-linked accounts, the highest privacy settings by default and guardian controls. The Virginia chapter of the American Academy of Pediatrics asked for more, including independent testing of safeguards and an outright ban on romantic or sexual interactions with minors. Chair Del. Cliff Hayes called the package a starting point. Funding and which agency enforces it remain unresolved.

What changed: Most of the twelve enacted laws regulate minors' access and leave adult sexual companion content alone. Virginia's framework would be the first U.S. state approach to put adult romantic and sexual content behind an account-level opt-in. That is a design requirement, not a ban, but it would mean an account and age-gate step for every adult companion product serving Virginians. Expect bill text when the 2027 session opens in January.

New Sources