AI Companion Chatbots and Minors: The US State Regulation Wave Reshaping EdTech in 2026

Why 2026 Became the Year of Minor-Focused AI Legislation

The surge in US legislative activity around AI chatbots and minors is not occurring in a policy vacuum. It follows a series of high-profile lawsuits — and at least one widely reported teen suicide — in which plaintiffs alleged that AI companion platforms failed to protect young users from harmful conversations, self-harm content, and emotionally manipulative dynamics. The lawsuits created political pressure that translated, with unusual speed, into legislative action at both state and federal levels. As of May 2026, at least 3 states have enacted companion chatbot laws this session and 5 more are in active consideration, with the federal GUARD Act advancing on a 22-0 committee vote in April 2026.

According to Multistate.us’s analysis of 2026 children’s online safety legislation, the three states that have enacted AI chatbot laws this session are Idaho (SB 1297), Oregon (SB 1546), and Washington (HB 2255). Maine and Nebraska are close to passage. The enacted laws share common core requirements: chatbots must not claim sentience, must not initiate sexual conversations with minors, must include periodic reminders that users are not talking with a human, and must have protocols for responding when users express self-harm ideation.

What makes 2026 distinct from earlier children’s online safety legislation is the scope. Previous waves — the Children’s Online Privacy Protection Act (COPPA), the Kids Online Safety Act (KOSA) — focused primarily on social media platforms and data collection. The current wave directly targets the conversational AI layer, reflecting regulators’ understanding that the psychological dynamics of AI companion relationships differ materially from passive content consumption.

The GUARD Act: Federal Legislation Advancing Fast

The Guidelines for User Age-verification and Responsible Dialogue (GUARD) Act represents the most comprehensive federal approach to AI chatbot regulation for minors to date. Biometric Update’s coverage of the bill’s advancement reports that the Senate Judiciary Committee passed the bill on a 22-0 bipartisan vote on April 30, 2026 — an unusually strong consensus signal for technology legislation.

The bill was introduced by Senator Josh Hawley and has bipartisan co-sponsors including Senators Richard Blumenthal, Katie Britt, Mark Warner, and Chris Murphy. Its core requirements are:

Age verification: Providers must implement “reasonable age verification” using government-issued ID, corroborated documentation, or information verified through financial institutions, device operating systems, or app stores. The law explicitly prohibits treating a shared IP address, device identifier, or other technical signal as sufficient proof of adult status.

Account requirement: All users must create accounts. Existing accounts are frozen upon enactment until age verification occurs.

AI companion ban for minors: Minors cannot access AI systems designed to “simulate interpersonal or emotional interaction, friendship, companionship, or therapeutic communication.” This provision goes significantly beyond disclosure requirements — it is an outright access prohibition.

Disclosure at conversation start: Chatbots must identify themselves as AI at conversation start. An earlier version required 30-minute interval reminders; the Senate Judiciary Committee amendment removed that provision.

Data minimisation: Providers must limit data collection to what is minimally necessary and protect it with industry-standard encryption.

Penalties: Civil and criminal sanctions apply for systems exposing minors to sexual content, with fines up to $250,000 per violation for knowingly presenting risks of sexual exploitation.

California SB 243: The Most Detailed State Framework

While the GUARD Act establishes federal minimums, California’s SB 243 — analysed in depth by the Future of Privacy Forum — creates the most operationally detailed state-level compliance framework. Signed into law in October 2025, SB 243 defines a “companion chatbot” as an AI system providing “adaptive, human-like responses” that meets social needs, exhibits anthropomorphic features, and sustains relationships across multiple interactions.

Key requirements under SB 243 include:

• Minor-specific safeguards: When operators know a user is a minor, they must disclose AI involvement, send break notifications every three hours, and prevent sexually explicit content suggestions.
• Self-harm protocols: Systems must prevent content related to suicidal ideation and direct users to crisis helplines. Operators must report anonymised crisis referral data annually to California’s Office of Suicide Prevention.
• Private right of action: Individuals can sue for minimum damages of $1,000, injunctive relief, and attorney’s fees — a liability mechanism absent from most companion chatbot laws.

SB 243 carves out customer service bots, internal research systems, video game chatbots (if they avoid mental health and self-harm topics), and standalone voice assistants. But the definition’s focus on “sustaining relationships across multiple interactions” is broad enough to capture personalised learning platforms, AI tutoring systems, and any chatbot with memory or relationship-building features.

The $1,000 minimum damages combined with private right of action creates a class action exposure that will be material for any company with meaningful minor user penetration in California. Industry groups are monitoring whether Governor Newsom will seek to preempt the GUARD Act’s stricter provisions — his October 2025 veto of California’s more restrictive AB 1064 suggests some preference for disclosure over outright bans.

The EdTech Compliance Dilemma

The wave of AI chatbot legislation creates a specific and difficult compliance problem for educational technology companies. EdTech platforms are designed to serve minors; they increasingly integrate AI tutoring, AI writing assistance, and personalised learning chatbots. But the scope definitions in SB 243 and the GUARD Act are broad enough to capture AI tutoring systems that “sustain relationships across multiple interactions” and exhibit “adaptive, human-like responses.”

Roll Call’s coverage of the GUARD Act’s Senate committee passage notes that industry group NetChoice called the bill “overinclusive, blunt,” specifically citing cybersecurity risks from mandatory age verification data collection — arguing that centralised age verification databases create “honeypots ripe for cybercriminals.” The Future of Privacy Forum’s analysis similarly flags the tension between SB 243’s self-harm detection requirements (which require monitoring sensitive mental health conversations) and California’s own privacy obligations under existing law.

For EdTech companies, the practical compliance path requires answering three questions: (1) Does my AI feature meet the “companion chatbot” or “AI companion” definition under the applicable law? (2) If yes, can I implement age verification that satisfies the law without creating unacceptable data security risks? (3) If the minor access ban applies (GUARD Act), can I segment my product so that the AI companion features are unavailable to verified minors while other AI-assisted features remain accessible?

What AI Product Teams Must Build Now

1. Implement a Tiered Age-Assurance Architecture

The technically safest compliance approach is a tiered architecture that does not require storing government ID data at all. The GUARD Act permits reliance on age signals from device operating systems (Apple’s Age Assurance framework, Google’s Family Link) and app stores (App Store, Google Play) — both of which have minor user detection capabilities that do not require the app operator to collect or store identity documents.

For web-based products, the options are more limited: app-store signals do not apply, and browser-level age assurance tools are still nascent. Companies should evaluate commercial age verification API providers that use probabilistic approaches (device fingerprinting, operator data sharing) rather than document upload, and document the reasonableness of their approach against the “reasonable age verification” standard the GUARD Act uses.

2. Redesign Companion Features With a Minor/Adult Bifurcation

The GUARD Act’s access prohibition for minors does not apply to all AI systems — only to those designed to “simulate interpersonal or emotional interaction, friendship, companionship, or therapeutic communication.” This means companies can maintain a single product with an architecture that disables companion-mode features for verified minors while keeping task-oriented AI assistance (information retrieval, writing support, coding help) accessible.

This requires a technical investment in feature flagging at the user account level, triggered by age verification status. The compliance documentation burden includes maintaining a feature matrix that maps user age categories to enabled/disabled AI capabilities, and demonstrating that the disabled features genuinely meet the companion chatbot definition while the enabled features do not.

3. Build Self-Harm Response Protocols Now — Regardless of Jurisdiction

California’s SB 243 requirement to detect and respond to self-harm ideation content is the provision most likely to expand beyond California, and it carries reputational risk in addition to legal risk. Companies that do not have self-harm response protocols in place are exposed both legally (in California) and in terms of platform trust.

The implementation standard is “evidence-based methods” — a deliberately broad formulation that the industry is still working to define. At minimum, companies should implement content classification for self-harm language, have tested redirect protocols to crisis helplines (988 Suicide & Crisis Lifeline is the US standard), and log anonymised crisis referrals for regulatory reporting. The Washington Hunton & Williams analysis confirms that Washington’s enacted law on companion chatbots includes a private right of action — adding litigation exposure on top of regulatory penalties.

The National Patchwork and What It Means for Product Strategy

The current landscape — three enacted state laws, federal legislation advancing, five more states close to passage — is the regulatory pattern that typically precedes a federal preemption moment. The GUARD Act’s 22-0 Senate committee vote suggests bipartisan consensus exists; the question is whether the full Senate and House will move quickly enough to establish federal standards before 10 or more states have enacted divergent frameworks.

For AI companies, the strategic calculation is whether to build to the highest current standard (GUARD Act + SB 243) or to maintain state-specific compliance stacks. Given the GUARD Act’s momentum and California’s market size, building to the federal-plus-California standard is the lower long-term cost path — even though it is the higher short-term cost.

Frequently Asked Questions

Sources & Further Reading

• State Children’s Online Safety Laws Expand Beyond Social Media in 2026 — Multistate.us
• US Lawmakers Move to Restrict AI Chatbots Used by Kids — Biometric Update
• Ban on Kids’ Companion Chatbots Advanced by Senate Committee — Roll Call
• Understanding the New Wave of Chatbot Legislation: California SB-243 and Beyond — Future of Privacy Forum
• Washington State Enacts Law Regulating AI Companion Chatbots — Hunton Privacy Blog