AI Companion Laws: What's Actually in Force, and What It Means for You

AI companion apps spent years in a regulatory grey zone. That ended. As of 2026 there are statutes with effective dates, penalty clauses and regulators who have already opened files on named companies. If you pay for a companion app, run one, or have a teenager who uses one, the rules now touch you.

This is a plain-language map. It covers what each law requires, when it started, who enforces it, and where the text is still vague. None of it is legal advice, and none of it comes from us testing anything. It comes from the statutes, regulator announcements and law-firm summaries.

The laws at a glance

Seven jurisdictions matter most right now. Four have binding rules in force. One has a study in progress. One has a bill that has cleared a committee but is not law.

Jurisdiction	Law	Status	Key duties	Enforcement
California	SB 243	In effect January 1, 2026	AI disclosure; suicide and self-harm protocols; 3-hour reminders and sexual-content limits for known minors; annual reports	Private suit: actual damages or $1,000 per violation, whichever is greater
New York	GBL Article 47	In effect November 5, 2025	Self-harm detection and crisis referral; AI disclosure at start and every 3 hours	Attorney General civil penalties
US federal	FTC 6(b) inquiry	Opened September 11, 2025	Information orders to seven companies on safety, minors, monetization	Study power; may lead to enforcement
US federal	GUARD Act	Passed Senate Judiciary April 2026	Would ban minors from AI companions; require age verification	Not law yet
EU	AI Act Article 50	Since August 2, 2026	Disclose AI; mark synthetic media	Fines up to €15 million or 3% of global turnover
UK	Online Safety Act	Age assurance since July 2025	Highly effective age checks for pornographic content	Ofcom investigations and fines
Australia	eSafety codes	Since March 9, 2026	Age assurance for companion chatbots; self-declaration insufficient on higher-risk services	eSafety Commissioner

Two things jump out. First, the rules differ in kind, not just in strictness: California gives users a private right to sue, New York hands enforcement to the Attorney General alone, and the EU regulates the output rather than the relationship. Second, almost every rule lands on the operator, not the user. You do not have to file anything. The company does.

What counts as a companion under these laws

Most statutes describe a system that responds to users in natural language and simulates a human relationship, often persistently, often with memory of past conversations. A generic chatbot answering product questions does not fit. A character that greets you by name and picks up yesterday's argument does.

That distinction matters because it decides who answers to SB 243 and Article 47. If you are unsure whether a given app counts, look at how it markets itself. Products that sell "girlfriend", "companion" or "relationship" language are squarely in scope. If you want a working definition of the category, our no-hype guide to AI companions covers it without the marketing gloss.

Why regulators moved so fast

Three pressures converged. Usage among minors turned out to be enormous: Common Sense Media's 2025 research found 72% of US teens aged 13-17 had tried an AI companion, 52% used them regularly and 13% daily. The same research recommended that under-18s abstain entirely.

Second, availability to minors was the default, not the exception. A July 2026 DeepSee analysis of 4,346 companion apps found that 60% were rated as available to minors, and cited that 36% of kids' companion use was sexual or romantic roleplay.

Third, the harm cases arrived. Character.AI, its founders and Google settled five teen-harm cases in January 2026 on confidential terms. Character.AI had already banned open-ended chat for under-18s from November 25, 2025. Kentucky Attorney General Russell Coleman sued Character Technologies on January 8, 2026 under the state Consumer Protection Act and Consumer Data Protection Act, alleging minors reached sexual, self-harm and drug chats after self-declaring their ages.

Regulators followed the headlines. The FTC, state attorneys general, Ofcom and Australia's eSafety Commissioner have all opened work on the sector.

California SB 243: the one with teeth

SB 243 has been in force since January 1, 2026, and it is the most specific companion statute in the US. Four obligations stand out.

• Disclosure. The service must make clear it is AI whenever a reasonable person could be misled into thinking otherwise. For known minors, the reminder must recur.
• Crisis protocols. Operators must have written protocols for suicidal ideation and self-harm, including referral to crisis support.
• Minors. Known minors get a break reminder every three hours and limits on sexual content. The three-hour rule is narrower than New York's, because it only attaches once the operator knows the user is under 18.
• Reporting. Annual reports go to the California Office of Suicide Prevention. The first is due July 1, 2027, according to law-firm summaries of the statute.

Enforcement is the part operators fear. Users can sue for actual damages or $1,000 per violation, whichever is greater. That is a per-violation figure, which means a recurring disclosure failure compounds.

New York Article 47: disclosure on a timer

New York's law took effect November 5, 2025, earlier than California's. It pairs self-harm detection and crisis referral with a blunt disclosure rule: tell users they are talking to AI at the start of a session and again every three hours, for every user. No minor carve-out on the timer.

The enforcement model is different. The Attorney General pursues civil penalties, and there is no private right of action. For users, that means you cannot sue under Article 47 yourself. For operators, it means one regulator decides what non-compliance costs.

The rest of the state map

California and New York are the headline acts. The supporting cast is filling in through 2026 and 2027.

State	What it does	Effective
Tennessee	Bars AI posing as a licensed mental health professional	July 1, 2026
Oregon (SB 1546), Washington	Companion safeguards with private rights of action	January 1, 2027
Nebraska (LB 525), Idaho	Companion chatbot rules	July 1, 2027
Utah, Texas	App Store Accountability Acts; age checks move to the app store	Check current status

Two caveats. Florida S 1344 and Georgia SB 540 have unconfirmed status and should be treated as proposals for now. Georgia's bill, per summaries from Persona and Morrison Foerster, would require hourly AI disclosure, which would be stricter than New York's three-hour clock. BillTrack50 counted more than a dozen states with proposed AI safety chatbot bills by early 2026, so expect this table to age.

Federal: inquiries, not a statute

There is no federal companion law. What exists is a study with subpoena power and one bill in committee.

The FTC opened a 6(b) inquiry on September 11, 2025, sending information orders to Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap and xAI. A 6(b) study does not fine anyone. It builds a record that can support later enforcement.

The GUARD Act passed the Senate Judiciary Committee unanimously on April 30, 2026. It would ban minors from AI companions and require age verification. It is not law, and committee passage is a long way from a statute.

Two older federal laws already bite. COPPA requires verifiable parental consent before collecting data from under-13s. The Take It Down Act, from May 2025, criminalizes non-consensual intimate images, deepfakes included. If you use a companion app to generate explicit images of a real person, that is the statute with your name on it.

EU: Article 50, GDPR and the €5 million lesson

The EU AI Act's Article 50 transparency duties have applied since August 2, 2026. Users must be told they are interacting with AI unless it is obvious. Synthetic media must be marked. Fines reach €15 million or 3% of global turnover, whichever is higher. Existing systems have until December 2, 2026 to comply with the marking duty.

One clarification that gets misreported: the Digital Omnibus pushed high-risk rules to December 2027, but Article 50 was not delayed. Article 5 has been in force since February 2025 and bans manipulative techniques, which is the provision a companion app designed to foster dependence should worry about.

Privacy is separate and older. GDPR treats data about sex life as a special category requiring explicit consent. Italy's Garante fined Replika developer Luka €5 million, decided April 10, 2025 and announced May 19, 2025, then opened a new probe into model training. That is the template: a privacy regulator, not a safety regulator, setting the first big number.

UK and Australia: age assurance with follow-through

Ofcom has enforced highly effective age assurance for pornographic content since July 2025. The first companion case was Novi Ltd, which runs Joi.com, a service with roughly 6.5 million monthly users worldwide in late 2025. Ofcom opened its probe on January 15, 2026 and closed it on July 31, 2026 without findings. No penalty, but the file is public and the sector noticed.

The UK government's February 2026 plan would close the one-to-one chatbot gap and bar under-18s from romantic or sexual bots. That is policy intent, not yet an enforceable rule.

Australia is further along. Age-restricted codes took effect March 9, 2026 and explicitly cover companion chatbots. Self-declaration is not enough on higher-risk services. Chub AI geoblocked Australia after an eSafety notice on October 16, 2025, and interim findings were published March 23, 2026. A reported fine of up to A$825,000 per day circulates widely; eSafety has not confirmed that figure, so treat it as reported rather than settled.

Age checks have moved into the app store

The quiet shift of 2025-26 is that age verification is migrating from the website to the operating system. Utah and Texas passed App Store Accountability Acts that put the check at the store level. Apple introduced 13+, 16+ and 18+ ratings and now asks developers to account for AI-generated responses. Apple's Guideline 1.1.4 removes primarily pornographic apps and requires AI output to be moderated.

The ratings themselves are inconsistent. Character.AI, Replika, Nomi and Kindroid are rated 18+ on iOS. DeepSee found 106 apps rated Teen on Google Play that were rated 17+ on iOS. A rating is not a guarantee.

There is also a structural gap: many explicit companion products are web-only and never touch an app store, so store policy never reaches them. That is where payment processors become the de facto regulator. Stripe and PayPal prohibit sexually explicit services. Mastercard's February 2026 rules cover platforms where users upload or generate adult content. In July 2025, card-network pressure pushed Steam and itch.io to delist adult games. A platform can follow every statute and still lose its ability to take your money.

What the major adult platforms actually do

Age checks vary more than the marketing suggests. Here is what the policies say for three platforms we review.

Platform	Operator	Age check	Watch out
Candy.ai	EverAI Limited (Malta)	18+ self-declaration; third-party estimation or ID may apply by location	No end-to-end encryption; de-identified chats may train models
Secrets AI	Secret Labs Inc.	Self-attestation plus AI moderation for underage signals; flagged accounts suspended	Encryption at rest and in transit only; the server can read chats
OurDream AI	Dream Studio USA, Inc.	18+ attestation; third-party ID or facial checks where required	Policy allows data use for AI training; proprietary moderation screens chats

Read that middle column carefully. Self-declaration is a click. ID or facial checks are a different experience, and they mean your government identity or your face is now in a vendor's pipeline. Candy.ai's operator sits in Malta and is therefore GDPR-bound, which is a stronger privacy floor than a US-only policy. We go deeper on its billing and privacy in our Candy.ai safety breakdown, and on the memory trade-off in the Secrets AI vs Candy.ai comparison.

The privacy gap nobody legislated

Every law above is about disclosure, minors or age. Almost none of them makes your chats confidential.

The technical reality is mundane. Messages are stored on servers. Most services are not end-to-end encrypted. Many reserve the right to train models on de-identified conversations. Age estimation can run on behavior even when you never upload an ID. And companion chats are not legally privileged the way therapy is, so a subpoena reaches them the same way an email does.

The security record supports caution. Mozilla's 2024 review found 10 of 11 romantic AI chatbots failed minimum security standards. A 2024 breach at Muah.ai exposed roughly 1.9 million email addresses plus explicit prompts. If a conversation would embarrass you in a courtroom, do not put it in a companion app and assume a statute protects it.

Mental health: what the evidence and the rules say

Both California and New York require self-harm detection and crisis referral. That is a floor, not a standard of care. No US companion law requires clinical oversight, and none makes a chatbot a therapist.

The research is correlational, and it cuts one way: an OpenAI and MIT Media Lab study in 2025 found heavier use correlated with loneliness, dependence and problematic use. Correlation is not causation, and the study does not prove the apps cause harm. It does mean heavy daily use is the pattern worth watching, in yourself or in someone you live with.

Tennessee's law, effective July 1, 2026, is the first to draw a hard line here: AI cannot pose as a licensed mental health professional. If a product markets itself as therapy, that is the statute to know.

If you or someone you know is in crisis in the US, call or text 988.

Compliance checklist for operators

If you run a companion product, the common core across these regimes is short. Do these before you scale.

1. Disclose. Say it is AI at session start, on a recurring timer, and whenever a user could be fooled.
2. Write the crisis protocol. Detection, scripted response, referral to local crisis lines, logging, review.
3. Decide how you know a user is a minor. Self-declaration will not satisfy the UK, Australia on higher-risk services, or the app-store regimes in Utah and Texas.
4. Filter sexual content for known minors and enforce break reminders.
5. Report. California wants annual reports to the Office of Suicide Prevention, first due July 1, 2027.
6. Map GDPR exposure if you have EU users. Sex-life data needs explicit consent, and Article 50 marking has a December 2, 2026 deadline for existing systems.
7. Audit your payment stack. Stripe, PayPal and Mastercard rules can end an adult platform faster than any regulator.
8. Read your own privacy policy. If it permits training on user chats, say so in plain language before a regulator does it for you.

Bottom line

The rules moved from guidelines to enforceable law, and the common core is consistent across borders: disclose that it is AI, have a self-harm protocol, keep minors away from sexual content, and verify ages with something better than a checkbox.

For adults, the practical effect is more notices, more age gates and a longer paper trail. For operators, it is real liability, including private suits in California and Oregon. For parents, the useful fact is that ratings and self-declarations are weak signals, and the UK and Australia have already said so in writing.

What the laws still do not give you is privacy. That stays a matter of reading the policy, limiting what you type, and remembering that a companion app is a vendor's server, not a sealed room.