In the absence of federal legislation, state lawmakers spent 2026 treating conversational AI as a product that can harm people, not merely a tool that processes data. According to the Future of Privacy Forum, 37 states introduced 124 chatbot-related bills that year. Thirteen of those bills became law, bringing the total of enacted state chatbot statutes across 2025 and 2026 to 18. The activity has been bipartisan. Republican sponsors led roughly 45 percent of the bills and Democratic sponsors 55 percent. The common thread is the recognition that systems designed to simulate ongoing human conversation—especially those that retain context, personalize responses, and encourage continued interaction—create risks that existing privacy and consumer-protection laws do not fully address.
Lawmakers who passed bills this year have been explicit about the distinction they are drawing. Iowa State Senator Kara Warme, a Republican, has noted that a chat interface on an insurance website is not the same as a service a user can take to a restaurant and treat as a date. Iowa’s Senate File 2417, the Conversational AI Chatbot Safety Act, which becomes fully applicable on July 1, 2027, focuses on public-facing services whose primary purpose is simulating human conversation. It requires clear disclosures to minor users that they are interacting with AI, prohibits unpredictable reward mechanisms aimed at increasing engagement with minors, bars sexually explicit or sexualized content directed at minors, and requires operators to adopt protocols that respond to prompts indicating suicidal ideation or self-harm by referring users to crisis resources. It also prohibits representing the system as a licensed mental-health professional. Enforcement runs through the attorney general, with civil penalties of $1,000 per violation up to a $500,000 cap per operator.
Oregon’s Senate Bill 1546, signed in 2026 and effective January 1, 2027, takes a similar approach but adds a private right of action. Operators of artificial-intelligence companions—systems designed to simulate a sustained human-like relationship—must notify users when a reasonable person would believe they are interacting with a natural person. They must maintain protocols that detect suicidal ideation or self-harm intent, prevent the generation of content that encourages those outcomes, and refer users to the 988 lifeline and, for younger users, a youth line. For users the operator has reason to believe are minors, the law imposes additional limits on content that simulates emotional dependence or romantic or sexual innuendo, and requires periodic reminders that the user is interacting with artificial output and should take a break. Individuals who suffer an ascertainable loss or other injury in fact may sue for the greater of actual damages or $1,000 per violation, plus attorney fees. Oregon State Senator Lisa Reynolds has described the private right of action as necessary to give the requirements “teeth.”
These statutes sit within a broader pattern. Most enacted chatbot laws emphasize three elements: disclosure that the user is speaking with AI, crisis-response protocols for self-harm and suicidal ideation, and heightened rules for minors. A smaller number create private rights of action (Oregon and Tennessee are examples); most rely on attorney-general enforcement. Definitions vary. Some laws target systems that exhibit relational behaviors such as retaining information across sessions; others focus on capability. Age thresholds and the degree of age assurance required also differ. The Future of Privacy Forum has documented the resulting compliance landscape as fragmented, even while the core concerns remain consistent.
Mental Health as the Driver
The legislative push is closely tied to documented and alleged harms. High-profile lawsuits involving Character.AI and other platforms have alleged that companion chatbots engaged minors in sexualized conversations, failed to interrupt discussions of suicide or self-harm, and in some cases reinforced dependency or provided harmful advice. State attorneys general have cited testing that found frequent problematic interactions with accounts registered to children. Policymakers have also pointed to social-media experience as a caution: waiting for clearer evidence of harm before acting left platforms with years of unregulated optimization for engagement.
Speakers at the Future of Privacy Forum’s recent discussion noted that chatbots differ from many other AI systems because they can remember prior conversations, personalize responses, and create the impression of an ongoing relationship. Common Sense Media’s Brenna Leasor has argued that regulation should look not only at what systems say but at how they say it—tone, persistence, and the absence of the friction that characterizes real-world relationships. Underage users, she and others have observed, can have more difficulty distinguishing immersive chatbot interactions from human ones. When those design choices are combined with engagement metrics that reward longer sessions, the risk of harmful attachment increases. Not every participant treats personalization itself as the problem. Information Technology and Innovation Foundation analyst Alex Ambrose has noted that personalization is not inherently harmful; the concern arises when it is paired with gamification or other mechanisms that drive compulsive use.
Several laws attempt to interrupt that loop. Requirements to detect crisis language and surface the 988 lifeline or similar resources are among the most common provisions. Periodic disclosure reminders and limits on addictive reward patterns for minors appear in multiple statutes. Reynolds has described Oregon’s mental-health-resource requirement as a modest but concrete win, one she hopes parents and children will actually use.
The Patchwork and the Federal Vacuum
State lawmakers are aware of the compliance costs created by divergent rules. Warme and Reynolds have both acknowledged that inconsistent requirements can burden companies and could eventually invite federal preemption. Reynolds has said she would prefer meaningful federal legislation but views the current state patchwork as the second-best outcome while Congress and many companies remain inactive. Warme has framed the states as testing grounds: different approaches can be tried, outcomes observed, and lessons carried forward.
Congress has introduced chatbot bills, but none had been enacted by the time the Future of Privacy Forum published its September 2026 report. The result is a set of state rules that share goals—transparency, crisis intervention, minor protections—while differing in definitions, thresholds, enforcement mechanisms, and effective dates. For operators that offer services nationwide, the practical task is to identify the most stringent applicable requirements and decide whether to apply them more broadly or maintain state-specific implementations. Either choice carries cost and residual risk.
The deeper issue the legislation surfaces is that engagement-optimized conversational systems can produce harms that are difficult to reverse once they occur. Disclosure and crisis protocols do not eliminate the underlying design incentives, but they establish a baseline expectation that operators will detect high-risk conversations, interrupt them, and direct users to help. Whether those measures prove sufficient will depend on how rigorously they are implemented and enforced. For now, the states have decided that waiting for a single federal standard is not an acceptable alternative.