State AI Chatbot Laws: What the 2026 Wave Requires

This post is informational and reflects the state of the law as of August 2026. Chatbot legislation is moving quickly. For a specific product, consult a licensed attorney.

Chatbot regulation stopped being a coastal problem in 2026. By the middle of the year, eleven states had enacted laws regulating consumer-facing AI chatbots: California, Colorado, Connecticut, Georgia, Idaho, Iowa, Nebraska, New York, Oregon, Rhode Island, and Washington. Hawaii was one signature away from making it twelve. If your product includes a chatbot, or any AI system that talks back to users, this is no longer a one-state compliance question.

The reassuring part is that these laws look more alike than different. Most are built on the same two-tier structure, so a company that builds to the pattern is most of the way to compliance in every state that follows it. The work is in the details, which is where the states diverge.

Who the laws cover

Each of these laws regulates the entity that deploys the chatbot to the public, usually called the operator. The underlying model does not matter. If your organization makes the bot available to users, you are responsible for compliance, whether you built the model or licensed it from a vendor.

Where the states diverge most is in which chatbots they regulate, and there are roughly three approaches:

The broad approach (Colorado, Idaho, Iowa, Nebraska) reaches any conversational AI accessible to the public that primarily simulates human conversation. It is not limited to companion apps.
The functional-companion approach (California, Connecticut, Washington) targets “companion chatbots” but defines them by capability, not by design intent, capturing systems able to give human-like responses and sustain a relationship across interactions. This definition can reach many general-purpose chatbots in use today, even ones never marketed as companions.
The narrow approach (Georgia, Hawaii, New York, Oregon, Rhode Island) targets companion chatbots more narrowly.

The practical takeaway: do not assume a “we don’t make a companion app” answer settles the question. Under the functional definitions, a general-purpose support or sales bot can be in scope.

The two-tier structure

Every user gets a baseline. Two protections show up across the laws. First, identity disclosure: if a reasonable person might not know they are talking to AI, the system has to say so. User perception controls, which means a line buried in your privacy policy does not do the job. Second, self-harm response: when a user expresses suicidal ideation or a mental-health crisis, the system has to route them to a real crisis resource rather than continue the conversation as if nothing happened.

Minors get more. Several of these laws layer additional requirements on users the operator knows or should know are under 18: more frequent AI disclosures, restrictions on sexual or manipulative content, and, in some states, limits or bans on companion-style features for that age group. The specifics vary, so a chatbot serving a general audience needs to account for the possibility that minors are using it.

Where your user sits usually decides the rules

These are consumer-protection laws, so in most cases the user’s home state sets the requirements, regardless of where your company is headquartered. That has a design consequence worth raising with your product team: does the chatbot know where the user is, and does its behavior change by state? If the answer is no, you likely run the same bot everywhere, which means the strictest state’s rules effectively govern the whole experience.

What to do now

Two questions to run against your own product:

Does your chatbot identify itself as AI at the start of a conversation, and again if a user asks directly?
When your system detects self-harm language, does it actually route the user to a crisis resource, or does the conversation just keep going?

If you cannot answer both cleanly, that is the place to start. From there, map your user base against the states that have acted, decide whether to build state-aware behavior or default to the strictest standard, and give minors’ protections particular attention, because that is where the laws are most demanding and the exposure is highest.

Waiting for your own state to pass one of these before you look is not a strategy. The pattern is set, and the list of states is still growing. (For how this fits alongside AI use policies and broader compliance, see the firm’s AI Governance and Privacy & Data Security practices.)

If your product has a chatbot and you are not sure where it stands, talk to MB Legal.

This post is informational and does not constitute legal advice. State chatbot laws vary in scope and detail and are changing quickly. For guidance on a specific product, consult a licensed attorney.