What the law requires
California Governor Gavin Newsom signed SB 1119, known as Adam’s Law, on 10 September, setting child-safety rules for companies that run companion chatbots. The governor’s office said it is the first law in the country to require companies to conduct independent child-safety audits and annual risk assessments.
The bill was written by Senator Steve Padilla with Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan. It is named after Adam Raine, a California teenager who died by suicide in 2025 after receiving tips from ChatGPT, CalMatters reports. It passed the Senate unanimously and the Assembly 64–4, according to Padilla’s office.
Under the enrolled bill text, a child is anyone under 18, and the rules cover operators that make companion chatbots available to child users in California. Before releasing a new or substantially modified chatbot, an operator must assess its child-safety risks. It must offer in-app crisis support with mental health referrals, and notify a parent as soon as practicable when it detects a credible, imminent risk of self-harm, unless that notice could itself put the child in serious danger.
Defaults only a parent can change
The most concrete provisions are the defaults. For child users, persistent conversational memory is switched off, a single continuous session is limited to one hour, and total time with an operator’s companion chatbots is capped at two hours a day. Padilla’s office says notifications are also off by default, and that these settings can be changed only by a parent. The governor’s office adds that parents are notified if a child disables safety settings.
Operators must establish a user’s age with privacy-protective age-bracket signals, and are liable for failing to stop their chatbots from producing self-harm coaching, sexually explicit material, romantic role-play, excessive flattery or emotionally manipulative content, according to Padilla’s office. Targeted advertising to children is strictly limited.
Audits, penalties and deadlines
The core protections become operative on 1 July 2027. The Attorney General must set up a public incident-reporting mechanism by 1 January 2028. Independent child-safety audits, submitted to the Attorney General, are due by 1 January 2029, or before a chatbot is first made public if that is later, and every two years after that.
Public prosecutors can seek civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional one. Children and parents can also sue for damages when a violation causes them real harm.
Who does the auditing is covered by a separate law: Newsom has also signed AB 1405, which creates a state registry of AI auditors with standards for their independence.
OpenAI’s support, and the wider package
OpenAI, whose product is at the centre of the case the law is named for, backed the measure. The company has said it “pairs strong protections with continued access to useful AI tools,” CalMatters reported.
“We cannot make the same mistakes that were made with social media,” Padilla said. Matt and Maria Raine, Adam’s parents, said they were confident the law “will save lives and prevent other harms.” Newsom said California “will not stand by while unregulated technology puts our children at risk.”
SB 1119 was one of 13 child online-safety bills Newsom signed on the same day. SB 867, also by Padilla, places a four-year moratorium on AI-powered chatbot toys for children under 16, CalMatters reports. AB 1709 requires social media companies to either stop offering “addictive” features such as infinite scroll and autoplay to users under 16 or keep those users off their platforms. The Electronic Frontier Foundation had urged Newsom to veto that bill, calling it “well-intentioned, but deeply flawed”. The chatbot law drew broader support.
What to watch
Adam’s Law builds on California’s 2025 chatbot law, SB 243, and Padilla says he expects it to become a national model. The dates are now fixed: July 2027 for the core protections, January 2028 for the Attorney General’s reporting channel, January 2029 for the first audits. The practical tests before then are how operators identify child users from age-bracket signals, and how products built around long conversations adapt to a two-hour daily default.
