California SB 243 Companion Chatbot Compliance: Operator Duties, Minor Protections, and the Private Right of Action

California SB 243, signed by Governor Newsom on October 13, 2025 and effective January 1, 2026, imposes three core duties on operators of "companion chatbots" — AI systems designed to provide adaptive, human-like social and emotional interactions — including AI disclosure when reasonable users would be misled, minor-specific protections (every-three-hour break reminders, sexual-content controls, AI-disclosure-on-known-minor), a suicide and self-harm intervention protocol with crisis-service referrals, and a private right of action with damages of the greater of actual damages or $1,000 per violation. The bill makes California the first state in the nation with a companion-specific chatbot regulatory regime, and the post-AB-1064-veto landscape — Governor Newsom signed SB 243 on the same day he vetoed the more restrictive AB 1064 — tells operators where the current ceiling is. This article walks through what counts as a companion chatbot, what the three core duties actually require operationally, how the private right of action interacts with AB 316, and what compliance posture operators are converging on for the August 2026 enforcement window.

What counts as a "companion chatbot" (and what doesn't)

The threshold question every operator confronts under SB 243 is whether their product is a companion chatbot at all. The statute's definition is targeted: companion chatbots are AI systems that respond to users with adaptive, human-like responses and are designed to engage users in ways that can meet social or emotional needs. The targeted category is products like Character.AI, Replika, Chai, Talkie, and similar platforms designed for emotional companionship and ongoing simulated relationships. The legislative history makes the targeting explicit — the bill's precipitating events were teen suicide cases linked to companion chatbot platforms, including the well-publicized Sewell Setzer case that drew national attention in early 2024.

Several categories of AI conversational systems are explicitly outside scope. Customer service bots that handle transactional inquiries are not companion chatbots, even when they use natural language. Video game characters with limited dialogue are not companion chatbots, even when they have personalities. Voice-activated virtual assistants like Alexa or Siri are not companion chatbots, because they handle discrete tasks rather than sustaining relationships. The dividing line is the system's design intent and observed engagement pattern. A chatbot designed to handle a billing dispute and then close out is not in scope; a chatbot designed to be a friend, romantic partner, or emotional support system is in scope, even if its underlying technology is similar.

The harder cases are products that sit between transactional and companion use. A mental-health-adjacent chatbot that provides emotional support but is marketed as a wellness tool may or may not qualify depending on how the use pattern shakes out in practice. A productivity assistant with extended personality features may qualify if users are using it for emotional engagement even when it was designed for productivity. Operators in these middle cases should conduct a fact-specific analysis: review the system's design documents, marketing materials, and observed user behavior, and develop a written legal opinion on whether SB 243 applies. The opinion is the artifact that defends a compliance choice if a regulator or plaintiff later disagrees with the classification.

The three core operator duties

SB 243's substantive obligations decompose into three categories: disclosure, safety protocols, and accountability. Each category contains both general user obligations and additional minor-specific obligations, and the operational compliance work is to satisfy both layers simultaneously.

The disclosure duty is triggered by the reasonable-person test. If a reasonable person interacting with the companion chatbot would be misled to believe they are interacting with a human, the operator must issue a clear and conspicuous notification that the chatbot is artificially generated and not human. The notification must be clear enough that an ordinary user understands the disclosure without specialized knowledge. Most operators are implementing the disclosure as an opening message at the start of any conversation, supplemented by a persistent UI indicator (a small "AI" tag near the chatbot's name or avatar) that remains visible during interactions. For users the operator knows are minors, the disclosure is mandatory regardless of whether a reasonable adult would be misled — this is one of the minor-specific layers that increases the disclosure obligation when the user is under 18.

The safety protocol duty requires the operator to maintain a documented protocol for preventing the chatbot from producing suicidal-ideation, suicide, or self-harm content, including providing notifications that refer the user to crisis service providers (suicide hotlines or crisis text lines) when the user expresses suicidal ideation, suicide, or self-harm. The protocol must use evidence-based methods for measuring suicidal ideation, and the operator must publish details of the protocol on its website. The publication requirement is the most regulator-visible part of this duty — operators are putting a dedicated trust-and-safety page on their websites describing the suicide-prevention protocol, the evidence-based detection methodology, the crisis-referral mechanism, and the operator's incident handling. Annual reporting to the California Office of Suicide Prevention begins July 1, 2027, covering crisis-referral counts, detection-protocol details, and prevention-protocol details.

The accountability duty is the private right of action structure. Any person who suffers an injury in fact as a result of a violation may bring a civil action for injunctive relief, damages of the greater of actual damages or $1,000 per violation, and attorneys' fees and costs. The $1,000 per-violation floor matters operationally because it makes lawsuits viable in cases where actual damages would be hard to establish — a teen user who experienced a disclosure violation can recover the statutory minimum without proving quantified harm. The duties are cumulative to other legal duties, which means an SB 243 violation can stack with FTC unfairness liability, state UDAP claims, and common-law negligence claims for the same conduct.

The minor-specific protections layer

For users the operator knows are minors, three additional duties apply beyond the general-user duties. First, AI-disclosure is mandatory regardless of the reasonable-person test — every known minor must be told they are interacting with AI, even if a reasonable adult would not be misled by the interaction. Second, every three hours of continuing interaction the operator must provide a clear and conspicuous notification reminding the minor to take a break and reminding them that the chatbot is artificially generated and not human. The three-hour reminder is one of the most operationally distinctive provisions in SB 243; it requires conversation-state tracking that many existing companion chatbot platforms do not currently maintain at the granularity required. Third, the operator must institute reasonable measures to prevent the chatbot from producing visual material of sexually explicit conduct or directly stating that the minor should engage in sexually explicit conduct.

Layered on top of these three duties is the platform-level disclosure that companion chatbots may not be suitable for some minors, which must appear on the application, browser, or other format that a user uses to access the companion chatbot platform. The platform-level disclosure is independent of the in-conversation duties — it's a separate notice that operates as user-facing transparency about the product itself rather than as a conversation-specific disclosure.

The age-detection question hangs over all of this. SB 243's minor-specific duties apply when the operator knows the user is a minor, which leaves operators some interpretive room around what age-detection methodology is required. Self-declared age (a user entering their birthdate at signup) is the floor; reasonable additional mechanisms — age-verification services, behavior-based age inference, third-party age assurance — become more important as deployment scale grows. Operators are converging on a layered approach with multiple age signals and conservative defaults when the signals conflict, because the legal exposure from getting age detection wrong runs in both directions: under-detecting minors creates SB 243 liability, while over-detecting minors can affect adult user experience and raise discrimination concerns.

The post-AB-1064-veto landscape and what it tells operators

Governor Newsom signed SB 243 on the same day he vetoed AB 1064, the parallel companion chatbot bill that would have imposed a stricter regime including outright restrictions on companion chatbot availability for minors. The veto is a regulatory signal worth reading carefully. It tells operators that California's current regulatory approach is transparency-and-safety-protocols rather than minor-access-restrictions. SB 243's disclosure-and-protocol regime is the operative law, and the more restrictive approach AB 1064 would have introduced is not currently enforceable.

The Future of Privacy Forum's analysis put it well: the SB 243 framework reflects a legislative preference for disclosure-based safeguards over outright restrictions, and may preview future legislative debates about whether states will continue to favor disclosure frameworks or shift toward use restrictions. For operators, the practical implication is to plan compliance against SB 243's actual text rather than against the more restrictive provisions AB 1064 would have imposed. The veto does not foreclose future legislation in California — Senator Padilla and other proponents have signaled intent to expand the regime in subsequent sessions — but it sets the current baseline at SB 243's level.

Other states are moving on similar regimes. New York's S-3008C, enacted earlier in 2025, includes similar transparency and safety provisions. The federal Guidelines for User Age-Verification and Responsible Dialogue Act (the GUARD Act) has been introduced. Operators serving multiple states should expect a patchwork of similar-but-not-identical chatbot regimes, with California's SB 243 as the most prescriptive baseline currently in force.

The interaction with AB 316 and SB 53

SB 243 sits alongside two other January 1, 2026 effective-date California AI statutes that together substantially raise the civil-liability stakes for AI operators. AB 316 (Civil Code §1714.46) eliminates the "AI autonomously caused harm" defense in civil actions. SB 243 creates a private right of action with a $1,000 per-violation floor for companion chatbot violations specifically. A companion chatbot that contributes to user harm — particularly minor-user harm or suicide-related harm — can now face an SB 243 private action where the operator cannot defend by claiming the AI acted on its own under AB 316. The combined exposure is meaningfully higher than either statute alone.

For large frontier AI developers whose models power companion chatbot products, SB 53 (the Transparency in Frontier Artificial Intelligence Act) creates an additional documentation layer that becomes discoverable evidence in SB 243 private actions. A frontier developer's SB 53-mandated transparency report describing the model's known catastrophic-risk-relevant capabilities can become evidence in an SB 243 case alleging that the companion chatbot product caused user harm. Operators should plan integrated compliance across all three regimes rather than treating them as separate silos.

The compliance checklist for operators

For companion chatbot operators landing compliance for the January 1, 2026 effective date, the practical sequence is roughly as follows. First, conduct the threshold analysis: document whether your product qualifies as a companion chatbot under SB 243, with explicit attention to design intent, marketing materials, and observed user-engagement patterns. Second, implement the AI disclosure layer: opening-message disclosure, persistent UI indicator, platform-level suitability notice. Third, build the minor-detection and minor-treatment infrastructure: age signals, three-hour break reminder logic, sexual-content guardrails for known minors, mandatory AI disclosure for known minors. Fourth, draft and publish the suicide-intervention protocol on your website: detection methodology, crisis-referral mechanism, evidence-based measurement, incident handling. Fifth, prepare for the July 2027 OSP annual reporting cadence: instrument the relevant counters and protocol-effectiveness measurements now, even though the first report is over a year away. Sixth, draft an internal compliance memo: produce an in-house counsel memo explaining SB 243's implications for product, legal, trust-and-safety, and operations teams, with named owners for each required action.

The single most underestimated piece of work is the suicide-intervention protocol publication. The statute requires operators to publish the protocol details on their website, which means the protocol becomes a regulator-visible artifact and a compliance posture. Operators that draft the protocol carefully and publish thoughtfully build a defensible compliance narrative; operators that publish a thin or generic protocol create a target for both regulator inquiry and private litigation. The protocol publication is worth investing in.

Sources

The primary statute is SB 243 on California Legislative Information. Senator Padilla's signing announcement provides the legislative-intent record. For practitioner-grade analysis, Jones Walker's regulatory update, Skadden's overview, and the Future of Privacy Forum's analysis are the most useful references — Jones Walker is most operational, Skadden is most legal-mechanical, and FPF places SB 243 in the broader chatbot-regulation landscape. Watch the California Office of Suicide Prevention for any pre-effective-date guidance on the annual reporting mechanism, and watch California courts for early SB 243 private-action filings.