AI Companion Chatbot Laws by State: Twelve Statutes, One Rule, and Every Date

Twelve states have enacted AI companion chatbot laws as of October 27, 2026. That count follows one rule: a statute counts when it covers a consumer-facing AI that simulates human conversation or a relationship and requires both an AI-identity disclosure and a suicide or self-harm crisis protocol. If you have read a different number, it came from a different rule. Three of the twelve bind today, in New York, California, and Hawaii. Five more bind on January 1, 2027 and four on July 1.

Key Takeaways

• Twelve states, one rule. Eight regulate a companion by name, and four regulate any public-facing AI that primarily simulates human conversation. Counting by other rules gives eight, ten, or fourteen, and the difference is the rule, not the law.
• Two duties are universal. Every statute requires the operator to disclose that the chatbot is not human and to run a crisis protocol for suicidal ideation or self-harm; the states differ on the trigger, the interval, and whether the protocol is published.
• January 1, 2027 is the date. Washington, Oregon, Connecticut, Rhode Island, and Colorado bind that day. California’s SB 243 known-minor measures lapse the same day, and SB 1119’s child duties follow on July 1, 2027.
• Three states let users sue under the chatbot law itself. Oregon and California give the greater of actual damages or $1,000 per violation. Washington routes a consumer injured in business or property through its Consumer Protection Act. In the other nine the attorney general enforces the chatbot law. In five of them, on this article’s reading, a user could still invoke the state’s general consumer-protection law on its own terms.
• Enforcement is already here under general law. Ten state attorneys general have sued OpenAI, and the complaints reviewed here plead consumer-protection, design-code, and tort law. A federal trial court ruled at the pleading stage that a companion app is a product for design-defect claims, in a case since dismissed. None of these actions rests on a chatbot statute.

Which states have AI companion chatbot laws in 2026?

Twelve states have enacted one. Eight regulate a companion by name: California, Connecticut, Georgia, Hawaii, New York, Oregon, Rhode Island, and Washington. Four regulate any public-facing AI that primarily simulates human conversation, subject to exclusions, and aim their minor provisions at companion behavior: Colorado, Idaho, Iowa, and Nebraska. The rows in bold are the three in force. Colorado’s age-estimation duty has also applied since August 12, 2026.

AI companion chatbot laws by state, as of October 2026

The number depends on the rule, which is why published counts disagree. Counting only statutes whose defined term names a companion gives eight. Counting only statutes with duties keyed to a known or likely minor gives ten, because New York and Rhode Island protect every user the same way. Counting any statute that imposes a disclosure, crisis, or minor duty on a chatbot operator gives fourteen, because Maine’s commerce-chatbot disclosure law and Utah’s mental-health-chatbot law each carry one of the duties. Five states’ chatbot statutes sit beside the twelve under this article’s rule. Maine bars a person from using a chatbot “to engage in trade and commerce with a consumer” in a way that may mislead a reasonable consumer into believing it is human. The bar does not apply if the consumer is clearly and conspicuously told that “the consumer is not engaging with a human being.” Utah requires a mental-health chatbot to disclose that it is AI. Nevada bars an AI provider from representing that its system “is capable of providing professional mental or behavioral health care.” Illinois bars offering therapy or psychotherapy services, “including through the use of Internet-based artificial intelligence,” unless a licensed professional conducts them. Tennessee bars representing an AI system as a qualified mental-health professional. None of the five pairs an AI-identity disclosure with a crisis protocol, and none defines a companion.¹⁴

If your product remembers the user, asks how they feel, and keeps the conversation going, test it against the “who is covered” column first. The duties fall on the company that offers the chatbot to users. In Connecticut, Georgia, Hawaii, Idaho, Iowa, and Nebraska, the developer of an underlying model is not answerable for another company’s deployment.

What do the chatbot laws require?

State companion chatbot laws impose four families of duties: an AI-identity disclosure, a crisis protocol, minor safeguards, and reporting. The first two are what make a statute count here. Every one of the twelve requires the operator to tell the user it is not human, and every one requires a protocol for a user who expresses suicidal ideation or self-harm. The states differ on the trigger and the interval. California, Oregon, Hawaii, Connecticut, Idaho, Nebraska, and Iowa require the disclosure where a reasonable person would be misled into thinking the chatbot is human. New York, Washington, Georgia, and Rhode Island require it for every user, at the start of an interaction and at least every three hours, and Colorado requires it for every user at the first interaction each day and then every three hours or persistently. Georgia, Washington, Hawaii, and Connecticut shorten the interval to an hour for a minor. The crisis duty’s core is shared: respond to a user’s expression of suicidal ideation or self-harm by referring the user to crisis services. California’s version requires “a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, including, but not limited to, by providing a notification to the user that refers the user to crisis service providers, including a suicide hotline or crisis text line.” Washington and Georgia extend it to eating disorders. Rhode Island (“[p]ossible physical harm to others”), Connecticut, and Hawaii reach harm to others. New York, Oregon, Georgia, and Connecticut name the 988 Suicide and Crisis Lifeline, the national hotline. California, Oregon, Washington, and Connecticut require the protocol to be published, and Georgia requires a plain-language summary of it.¹⁵

The third family is where the states diverge, and it is aimed at companion behavior whatever the statute’s defined term. Ten of the twelve impose duties keyed to a known or likely minor, and these elements recur across them: no variable-reward mechanics (the unpredictable rewards that keep a user pulling the lever), measures against sexual content, measures against the chatbot claiming to be human or pursuing a romantic relationship, break reminders, and parental or screen-time tools. Georgia adds “commercially reasonable age assurance” before a sexual-content feature, and Colorado requires operators to estimate every user’s age. California’s own minor duties are in motion. SB 243’s measures for a known minor, an AI disclosure, a three-hour break reminder, and sexual-content measures, end December 31, 2026, when SB 1119 strikes them. From January 1, 2027 SB 1119 requires an operator either to determine each user’s age or to apply its child protections to every user. From July 1, 2027 its child duties begin, with a session limit, parental controls, and reasonable measures against fourteen behaviors. New York and Rhode Island carry no minor provisions and protect every user with the same disclosure and protocol.¹⁵

The fourth family is reporting, and seven states require it. California requires annual reports to the Office of Suicide Prevention from July 1, 2027. Washington and Georgia require a public count of crisis referrals. Oregon requires a public report each December 31 of its referral count and protocol. Rhode Island and Colorado require annual reports to the Attorney General from July 1, 2027. Hawaii requires annual reports to the Department of Health’s behavioral health administration from January 1, 2028. A report is the state’s audit trail, and an operator in those seven states should assume the referral count will be read against the protocol it published.¹⁵

If your product is live in more than one of the twelve states, build to the strictest version of each family. That means every-user disclosure every three hours with an hourly minor interval, a published 988 protocol, the full minor set, and a referral count you can publish. Most of the other states’ duties are satisfied on the way; check the state-specific items in the table, such as Colorado’s disclosure on a user’s prompt.

Which states let users sue?

Oregon, California, and Washington let users sue under the chatbot law itself. The other nine leave enforcement of the chatbot law to the attorney general, joined in Hawaii by the director of its Office of Consumer Protection. Oregon’s SB 1546 is the simplest private action. “An individual who suffers an ascertainable loss of money or property or other injury in fact as a result of an operator’s violation” may sue for “[t]he greater of the individual’s actual damages or statutory damages of $1,000 for each violation” and an injunction, and the court “may award a prevailing plaintiff attorney fees and costs.” California has two. SB 243 gives a user “the greater of actual damages or one thousand dollars ($1,000) per violation” plus injunctive relief and fees. From July 1, 2027 SB 1119 adds a child’s own action. A child who “suffers an actual harm” from a violation of the core child duties, or a parent on the child’s behalf, may sue. Financial harm must exceed $1,000 per child, and emotional harm must be “serious emotional distress.” Public prosecutors may also seek up to $5,000 per affected child for a negligent violation and $15,000 for an intentional one. A violation cannot ground a private claim under the Unfair Competition Law. Washington’s route is indirect and conditional. SHB 2225 makes a violation “an unfair or deceptive act in trade or commerce” for the Consumer Protection Act. That Act lets “[a]ny person who is injured in his or her business or property” sue for actual damages, costs, and fees. The court may treble the damages, with the increased award capped at $25,000. Whether a user’s emotional injury is an injury to business or property is a question that Act’s case law, not the chatbot statute, will answer.¹⁶

The nine attorney-general states close the door in different words, and five of them do not close it in terms. Four exclude a private right under any law, expressly or by making the Attorney General the sole enforcer:

• Hawaii: nothing in its statute “shall be interpreted as creating a private right of action to enforce this section or to support a private right of action under any other law.”
• Connecticut: its companion sections are “enforced solely by the Attorney General.” For the disclosure and crisis-protocol duties, section 42-110g of the Unfair Trade Practices Act “shall not apply,” and nothing in the section provides “the basis for a private right of action.”
• Iowa: its chapter does not create a private right of action “under this chapter or any other law.”
• Idaho: nothing in its chapter supports “a private right of action under any other law.” Its Attorney General may seek “one thousand dollars ($1,000) per violation, not to exceed five hundred thousand dollars ($500,000) per operator, or actual damages, whichever is greater.”

The other five create no private right of their own and, on this article’s reading, leave the general consumer-protection law in place:

• Nebraska says only that nothing in its act “shall be interpreted as creating a private right of action,” which reaches a right the act itself would create.
• Georgia provides that nothing in its statute shall be construed to “[i]mpair any other remedy available at law or equity.”
• New York and Rhode Island create none of their own.
• From Jan. 1, 2027, Colorado’s Part 17 creates no “new private right of action” but preserves “any existing rights or remedies” under the Consumer Protection Act. It makes inapplicable any Act provision “inconsistent with the exclusive enforcement authority” of the Attorney General, which it grants in terms only for the automated-decision sections.

On this article’s reading, neither silence nor a clause limited to the act ends the private exposure in those five. Whether a user, or a class of users, can sue there turns on the state’s general consumer-protection statute. Each has its own requirements of injury and deception and its own limits on class actions. Under the chatbot statutes themselves, the exposure in all nine is a state suit. The operator’s record of its protocol and disclosures is what the Attorney General reads first.¹⁶

If you have users in Oregon or California, $1,000 per violation is the number to model, and a disclosure defect across a user base can become a class claim. In Washington the number is actual damages to business or property, which the court may treble, with the increased award capped at $25,000. In the other nine the chatbot law is an attorney-general matter. In Colorado, Georgia, Nebraska, New York, and Rhode Island the general consumer-protection law is a second route to model.

What has enforcement looked like so far?

Enforcement against chatbot operators has not waited for the chatbot statutes. Each complaint reviewed for this article rests on consumer-protection, design-code, data-protection, or tort law rather than a chatbot statute. That pattern is the one to plan around. Florida sued OpenAI and its chief executive on June 1, 2026 and moved for a temporary injunction on September 28. Nebraska sued on October 14 under its Consumer Protection Act, its Uniform Deceptive Trade Practices Act, and its Age-Appropriate Online Design Code Act, with negligence and products-liability counts beside them. The same day it announced that seven other states had sued in their own courts: Iowa, Kansas, West Virginia, Arizona, Arkansas, Idaho, and Montana. Texas sued OpenAI and its chief executive on October 23 under its Deceptive Trade Practices Act and its SCOPE Act, the state’s minors’ online-protection law. Kentucky sued Character Technologies in January 2026 under its consumer-protection and data-protection acts.¹⁷

The private cases moved first. Garcia v. Character Technologies is a wrongful-death suit over a teenager’s relationship with a companion character, filed in a federal trial court in Florida. The court ruled at the pleading stage that the app “is a product” for the products-liability claims so far as they “arise from defects in the Character A.I. app rather than ideas or expressions within the app,” that it was “not prepared to hold that Character A.I.’s output is speech,” and let those claims proceed. The parties filed a notice of resolution on January 7, 2026. The court dismissed the case without prejudice that day, subject to the parties’ right to submit a stipulated final judgment or to reopen. The company filed for Chapter 11 bankruptcy reorganization on October 12, 2026, and the plaintiffs filed a notice of voluntary dismissal with prejudice on October 15, 2026. The Federal Trade Commission issued orders on September 11, 2025 under section 6(b) of its Act, the provision that compels companies to answer the Commission’s questions, to seven companies: Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap, and X.AI. The orders ask how the companies measure, test, and monitor their chatbots’ potential negative effects on children and teens. As of October 29, 2026 the Commission has published no report from them. None of the actions above rests on a chatbot statute, which is what one would expect of statutes most of which bind in 2027.¹⁷

If you are building a compliance program to the statutes alone, the attorneys general are suing under consumer-protection, design-code, and tort law today. The statutes set the floor, not the exposure.

Is a federal chatbot law coming?

Not yet, and the one bill that moved would ban rather than regulate. The GUARD Act, S. 3062, would bar minors from AI companions. It was reported and placed on the Senate calendar on May 11, 2026 and has not had a floor vote. Nothing has been enacted, no federal agency has a chatbot rule, and the FTC’s inquiry is a study rather than a rulemaking. Nothing enacted displaces the state duties. The federal preemption campaign and Colorado’s enforcement stay are followed in the AI Regulation Tracker.¹⁸

If a board member asks whether to wait for Congress, the answer is no. The operative dates are in the states, and the federal bill that moved would add a ban, not relief.

What should a chatbot operator do now?

Within 30 days: the coverage check. Test the product against the “who is covered” column, state by state, and write the answer down. A product that remembers the user, asks unprompted emotion-based questions, and sustains a personal dialogue meets the three-feature definition that New York, Oregon, Georgia, Hawaii, and Rhode Island share. A natural-language product that gives adaptive, human-like responses and can sustain a relationship across sessions meets Washington’s and Connecticut’s definitions. It meets California’s if it can also meet a user’s social needs. A public-facing product that primarily simulates human conversation meets Idaho’s, Nebraska’s, Iowa’s, and Colorado’s unless an exclusion applies. Then check the exclusions. A customer-service bot that does not sustain a relationship is out everywhere. On this article’s reading, a general assistant is inside the four-state test unless it fits an exclusion for developer, narrow-topic, or business-only tools; no regulator has yet answered that question. Confirm the disclosure and the crisis protocol are live now in New York, California, and Hawaii, and the known-minor measures in California and Hawaii.

By January 1, 2027: the five-state wave. Washington, Oregon, Connecticut, Rhode Island, and Colorado bind that day. Set the disclosure to every-user, start-and-every-three-hours, with an hourly interval for a known minor. Publish the crisis protocol with a 988 referral. Build the minor set, including the no-variable-rewards rule and the sexual-content measures. In Colorado, confirm the age estimation for every user. The act took effect August 12, 2026, and states that duty without a later date. On this article’s reading, the stipulated order noted in the table may bar Colorado enforcement for now, but it changes no duty.³ California’s known-minor measures under SB 243 lapse the same day, and its § 21811 choice, determine age or protect every user, begins. Keep the minor measures on rather than switching them off for six months.

By July 1, 2027: California’s child duties and the four-state wave. Georgia, Idaho, Nebraska, and Iowa bind that day. In California, SB 1119 requires an operator that allows child users, before making a new or substantially modified companion chatbot available, to “[p]erform and document a comprehensive risk assessment” of its design, configuration, and operation with respect to child users, and to take and document measures that reasonably mitigate the risks it identifies. The first decision is whether to allow child users at all. An operator that bars them after age determination escapes most of SB 1119 but must publish how it meets the age-assurance rule. If you allow them, start the assessment now. The child-safety audit the Attorney General may request for cause is built on it.¹⁹

Ongoing: audit readiness. SB 1119’s independent child-safety audits are due by January 1, 2029, with operators under $500 million in revenue exempt until 2032, and the operator must send the Attorney General a summary of each audit report within 30 business days.¹⁹ The reporting states will read the referral count against the published protocol. Keep the disclosure logs, the protocol version history, and the referral counts from day one. They are the evidence in every one of the twelve states and in the consumer-protection suits that are already running. Astraea Counsel maps a chatbot’s features to each state’s definitions and duties; to have yours mapped, ask for a coverage review.

Conclusion

The companion-chatbot duties are more uniform than the competing counts suggest. The exposure sits in the variation, in minor safeguards and private rights. The statutes will keep coming in the 2027 sessions, and this page’s count will move with them, under the rule stated at the top. If you want your product tested against the twelve definitions, contact Astraea Counsel.

“The count is not the hard part. The hard part is that three of these laws bind today, five more on January 1, and every one of them turns on whether your product fits a definition you did not write.”—Chanté Eliaszadeh, Principal Attorney, Astraea Counsel APC

Related Resources

• California AI Laws 2026: The AI Regulation Tracker
• California AI Bills Signed September 2026: All Twenty-Seven, With Dates and Penalties
• Not an Agent. Not a Defense: Seven Doctrines That Already Hold AI Deployers Liable
• State AI Law Patchwork: 50-State Compliance Map

Change log

• October 29, 2026: first publication, current to the statutes enacted through October 27, 2026, under the two-duty counting rule stated in the opening section; the firm’s AI Regulation Tracker carries the same rule and count.

This article provides general information for educational purposes only and does not constitute legal advice. Artificial intelligence and consumer-protection regulation is evolving rapidly. Consult qualified legal counsel for advice on your specific situation.

Footnotes

1. S.B. 243, Stats. 2025, ch. 677 (Cal. Bus. & Prof. Code §§ 22601(b), 22602(a), (b), (c), 22603, 22605) PDF; S.B. 1119, Stats. 2026, ch. 190 (§§ 21810.5, 21811, 21812(d), 21813, 21816; § 1, striking § 22602(c) effective Jan. 1, 2027) PDF. ↩

2. Colo. H.B. 26-1263, 2026 Colo. Sess. Laws ch. 208 (C.R.S. §§ 6-1-1701(3.5), 6-1-1708; § 3, effective Aug. 12, 2026) PDF. The act sits in Part 17 of the Colorado Consumer Protection Act, which the Attorney General enforces. S.B. 26-189, 2026 Colo. Sess. Laws ch. 131 PDF, repeals and reenacts Part 17 effective Jan. 1, 2027 (C.R.S. §§ 6-1-1706(1), (2), (4), 6-1-1709(1)), and the 2026 Colorado Revised Statutes harmonize the two acts by relocating the conversational-AI section to § 6-1-1710 and its definition to § 6-1-1701(4.5) from that date, https://olls.info/crs/crs2026-title-06.htm. Until then, Part 17 as enacted by S.B. 24-205, 2024 Colo. Sess. Laws ch. 198 PDF, provides that “the attorney general has exclusive authority to enforce this part 17.” C.R.S. § 6-1-1706(1). ↩

3. X.AI LLC v. Weiser, No. 1:26-cv-01515-DDD-CYC (D. Colo. Apr. 27, 2026), ECF No. 24 (minute order) PDF, https://storage.courtlistener.com/recap/gov.uscourts.cod.253513/gov.uscourts.cod.253513.24.0.pdf; docket, https://www.courtlistener.com/docket/73171074/x-ai-llc-v-weiser/ (last visited Oct. 29, 2026); Colorado Department of Law, Notice of Proposed Rulemaking, 4 CCR 904-6, Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules, Colo. Sec’y of State tracking no. 2026-00360 (notice filed Aug. 11, 2026), https://www.sos.state.co.us/CCR/eDocketDetails.do?trackingNum=2026-00360 (last visited Oct. 29, 2026). As of October 29, 2026 the docket shows no later order changing the stay, and Colorado’s implementing rules remain proposed. The order reaches S.B. 26-189, which replaces S.B. 24-205’s Part 17, on its words; that it may reach H.B. 26-1263 is this article’s reading. ↩ ↩²

4. Conn. Pub. Act No. 26-15, §§ 4(1), 5(a) to (c), 6 PDF. ↩

5. Ga. S.B. 540, Act 518 (2026) (O.C.G.A. § 39-5-6(a) to (m)) PDF. ↩

6. Act 248, 2026 Haw. Sess. Laws (S.B. 3001), § 3 PDF; Haw. Rev. Stat. § 480-2(a), (d) PDF. ↩

7. Idaho S. 1297, ch. 249, 2026 Idaho Sess. Laws (Idaho Code §§ 48-2101 to 48-2105) PDF. ↩

8. Iowa S.F. 2417, 2026 Iowa Acts ch. 1068 (Iowa Code §§ 554J.1 to 554J.6) PDF, https://www.legis.iowa.gov/legislation/billTracking/billHistory?billName=SF%202417&ga=91. ↩

9. Neb. L.B. 525, 109th Leg., 2d Sess. (2026), §§ 12 to 19 PDF, https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB525.pdf. ↩

10. N.Y. Gen. Bus. Law § 1700 PDF, § 1701 PDF, § 1702 PDF, § 1703 PDF, § 1704 PDF (L. 2025, ch. 58, pt. U, § 1, eff. Nov. 5, 2025) PDF. ↩

11. Or. S.B. 1546, 2026 Or. Laws ch. 85, §§ 1, 2 PDF. ↩

12. R.I. S. 2195 Sub. A, 2026 R.I. Pub. Laws ch. 376 PDF, https://webserver.rilegislature.gov/PublicLaws/law26/law26376.htm. ↩

13. Wash. Substitute H.B. 2225, ch. 168, Laws of 2026, §§ 2 to 6, 9 PDF; Wash. Rev. Code § 19.86.090 PDF. ↩

14. Me. P.L. 2025, ch. 294, § 1 (L.D. 1727, approved June 12, 2025), enacting 10 M.R.S. § 1500-Y PDF, https://legislature.maine.gov/legis/bills/getPDF.asp?paper=HP1154&item=3&snum=132; Utah H.B. 452 (2025), Utah Code § 13-72a-101 et seq. PDF; Nev. A.B. 406, 2025 Nev. Stat. ch. 283, § 7 PDF, https://archive.leg.state.nv.us/Session/83rd2025/Bills/AB/AB406_EN.pdf; Ill. P.A. 104-0054 (H.B. 1806, eff. Aug. 1, 2025), Wellness and Oversight for Psychological Resources Act, § 20(a) PDF, synopsis at https://ilga.gov/Legislation/BillStatus?DocNum=1806&GAID=18&DocTypeID=HB&SessionID=114&GA=104; 2026 Tenn. Pub. Acts ch. 647, § 1 PDF. Hawaii’s Act 247 (H.B. 2137) regulates digital imitations, not chatbots, and is not counted PDF. ↩

15. The duty pinpoints: Cal. Bus. & Prof. Code §§ 22602(a), (b), (c), 22603 PDF; §§ 21811, 21812(d), 21813 PDF; N.Y. Gen. Bus. Law §§ 1701, 1702 PDF PDF; Wash. ch. 168, §§ 3 to 5 PDF; Or. ch. 85, § 1(2) to (5) PDF; O.C.G.A. § 39-5-6(b) to (j) PDF; Haw. Act 248, § 3(a) to (e) PDF; Conn. P.A. 26-15, §§ 5(a), (b), 6 PDF; R.I. 2026 ch. 376, §§ 6-64-2, 6-64-3 (printed in the Lexis session-law copy under the bill’s original numbering, §§ 6-63-2, 6-63-3) PDF, https://webserver.rilegislature.gov/PublicLaws/law26/law26376.htm; Idaho Code §§ 48-2103, 48-2104 PDF; Neb. L.B. 525, §§ 14 to 16 PDF, https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB525.pdf; Iowa Code §§ 554J.2 to 554J.4 PDF, https://www.legis.iowa.gov/legislation/billTracking/billHistory?billName=SF%202417&ga=91; C.R.S. § 6-1-1708(2) to (6) (§ 6-1-1710 from Jan. 1, 2027; see note 3) PDF. ↩ ↩² ↩³

16. Or. ch. 85, § 2 PDF; Cal. Bus. & Prof. Code § 22605 PDF; § 21816(a) to (c) PDF; Wash. ch. 168, § 6 PDF; Wash. Rev. Code § 19.86.090 PDF; Haw. Act 248, § 3(f) PDF; Haw. Rev. Stat. § 480-2 PDF; Conn. P.A. 26-15, §§ 5(c), 6(c) PDF; Idaho Code § 48-2105 PDF; O.C.G.A. § 39-5-6(k), (m)(3) PDF; Neb. L.B. 525, § 18 PDF; Iowa Code § 554J.6 PDF; N.Y. Gen. Bus. Law § 1703 PDF; R.I. 2026 ch. 376, § 6-64-4 (printed in the Lexis copy as § 6-63-4) PDF; Colo. H.B. 26-1263 PDF (no enforcement clause of its own); S.B. 26-189, 2026 Colo. Sess. Laws ch. 131 PDF (C.R.S. §§ 6-1-1706(1), (2), (4), 6-1-1709(1)) (see note 3). ↩ ↩²

17. Nebraska Attorney General, press release (Oct. 14, 2026), https://ago.nebraska.gov/news/attorney-general-hilgers-announces-lawsuit-against-openai-deceiving-nebraskans-about-safety; Florida Attorney General, press releases (June 1, 2026), https://web.archive.org/web/20260601184446/https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-files-first-nation-state-led-lawsuit-against-openai-ceo, and (Sept. 28, 2026), https://web.archive.org/web/20260928200437/https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-files-temporary-injunction-against-openai-and-its-ceo; Texas Attorney General, press release (Oct. 23, 2026), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-openai-and-ceo-sam-altman-lying-users-and-harming-texans; Kentucky Attorney General, press release (Jan. 8, 2026), https://www.kentucky.gov/Pages/Activity-stream.aspx?n=AttorneyGeneral&prId=1857; Garcia v. Character Techs., Inc., 785 F. Supp. 3d 1157, 1179—80 (M.D. Fla. 2025) PDF; Garcia v. Character Techs., Inc., No. 6:24-cv-01903 (M.D. Fla.), docket (ECF Nos. 242, 244, 278), https://www.courtlistener.com/docket/69300919/garcia-v-character-technologies-inc/, and Plaintiffs’ Notice of Voluntary Dismissal with Prejudice (Oct. 15, 2026) (ECF No. 278), https://storage.courtlistener.com/recap/gov.uscourts.flmd.433581/gov.uscourts.flmd.433581.278.0.pdf; In re Character Techs., Inc., No. 26-11603 (Bankr. D. Del. filed Oct. 12, 2026), docket, https://www.courtlistener.com/docket/74951888/character-technologies-inc/; 15 U.S.C. § 46(b) PDF; FTC, press release, FTC Launches Inquiry into AI Chatbots Acting as Companions (Sept. 11, 2025) PDF, https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions; FTC, 6(b) Orders to File Special Report Regarding Advertising, Safety, and Data Handling Practices by Companies Offering Generative Artificial Intelligence (“AI”) Companion Products or Services (Sept. 2025) (last visited Oct. 29, 2026), https://www.ftc.gov/reports/6b-orders-file-special-report-regarding-advertising-safety-data-handling-practices-companies. ↩ ↩²

18. S. 3062, 119th Cong. (GUARD Act), reported and placed on the Senate calendar May 11, 2026, https://www.govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s3062.xml. ↩

19. S.B. 1119, Stats. 2026, ch. 190 (Cal. Bus. & Prof. Code §§ 21810.5(j)(1)(B), 21812(a)(1), (a)(4), (b), 21814; the act prints two versions of § 21814, and the version operative on A.B. 1405’s chaptering (Stats. 2026, ch. 178) governs) PDF. ↩ ↩²