States are rushing to regulate AI chatbots

Adults and children alike are turning to chatbots with some of their most personal questions, despite a confusing mix of fast-moving safety rules and legal protections that vary depending on where they live and when they use the chatbot. In March 2026, KFF found that one in six U.S. adults had used an AI tool or chatbot for information or advice about their mental health or emotional wellbeing in the previous year. Among adults aged 18 to 29, this rose to 28%.

Almost 100 different bills aimed specifically at regulating AI chatbots have been introduced across U.S. state legislatures in 2026 alone, according to a tracker maintained by the Future of Privacy Forum (FPF), a non-profit policy research organization. FPF is currently tracking 98 chatbot-specific bills across 34 different states, plus three proposals in Congress.

The public tracker, which is updated weekly, focuses on legislation that has passed at least one legislative chamber. FPF marks the various bills across six main provisions: Disclosure & Transparency, Age Assurance & Access Controls, Content Safety, Harm Prevention, Data Protection, and Liability & Enforcement. The various bills cover a range of products, from general-purpose chatbots and mental health-specific chatbots, to “companion” style bots designed to simulate ongoing relationships.

Though each bill differs, what’s relevant to all of them is a string of high-profile incidents in which chatbot interactions have been linked to harm, particularly involving minors and including incidents of suicide. Such incidents have led to investigations into chatbots and pushed lawmakers in dozens of states to act quickly. But with no comprehensive federal chatbot law in place, the proposed bills differ greatly, right down to the very definition of what a chatbot actually is, Wysa reports.

General-purpose chatbots can help with many kinds of tasks. Companion chatbots are designed to build an ongoing emotional connection with users. Mental health chatbots offer support linked to wellbeing or mental health. The risks can differ for each group, so a state law could cover one type of chatbot and leave another outside of the rules.

Of course, a chatbot’s official category might not reflect how people actually use it. Someone can talk to a general-purpose assistant for advice about anxiety, depression or relationships, even when the product was never designed as a mental health service. A 2026 study found that 17% of people surveyed had used ChatGPT for mental health support. Stress and anxiety were the most common reasons, followed by relationship problems.

What's already law

As of July 16, 15 states have signed chatbot-specific legislation: California, Connecticut, Colorado, Georgia, Hawai‘i, Iowa, Idaho, Maine, Nebraska, New Hampshire, New York, Oregon, Rhode Island, Utah, and Washington.

Harm detection and response are among the most common requirements across these laws. This requires providers to have protocols in place for identifying signs of self-harm or harm to others in chatbot conversations. Upon detection of such incidents, chatbots can be required to provide information about crisis services or direct a user to a crisis hotline. The frequency with which this provision appears makes it the closest thing to an emerging national baseline that currently exists.

Some people are forming emotional attachments to AI chatbots that can feel similar to online human connections, but users in some states will be reminded periodically that they are interacting with AI. The intervals at which these reminders occur vary by state and sometimes by user. For instance, Connecticut's law requires disclosure every three hours for adults, but hourly disclosures are required when the user is a minor.

This means that a 17-year-old could have a very different experience depending on where they live. In one state, the chatbot may have to remind them every hour that it is not human. It may also need to tell them to take a break or allow a parent to oversee the account. In another state, it could be that none of those chatbot-specific protections apply. Some laws have already taken effect, while others have been agreed upon, but will not take effect until the future.

Specific protections aimed at children are common, too. Several enacted laws restrict sexual content or content that encourages self-harm for users under 18. Several states, including Colorado, Iowa, Idaho, and Nebraska, also require platforms to give parents tools to oversee or control a minor's account.

A newer category of restriction targets what FPF calls humanized or emotional systems and relates to chatbots designed to foster emotional attachment, isolate, or create a sense of secrecy between the user and the bot. Georgia, Idaho, Nebraska, Oregon, and Washington have enacted some version of this restriction, with Oregon and Washington specifically flagging sycophancy, meaning a chatbot's tendency to excessively agree with or flatter users, as a concern.

What’s not yet law

Several significant bills related to AI chatbots are in motion, having passed at least one legislative chamber, but haven’t yet been signed. California’s SB1119/AB2023 bill meets this category. The bill would add requirements for chatbot risk assessments, independent audits, age verification, and testing before deployment, on top of provisions already common in other states.

New York has two further bills that have passed the full legislature but have not been signed as of the date of the FPF tracker. Other proposals have passed one legislative chamber in California, Michigan, and Pennsylvania.

However, having bills in motion does not guarantee a clear pathway to their passage as law. In Arizona, the HB2311 artificial intelligence bill banning AI systems from claiming sentience or acting like mental health professionals passed the legislature but was vetoed by the governor. Similarly, several other bills in states such as Maryland, Oklahoma, and Washington stalled, and are now considered inactive.

AI chatbot regulation is patchwork

According to FPF, the core challenge the U.S. faces is that there is no shared definition of what constitutes a chatbot across these bills. Definitions of "chatbot" differ widely, contributing to an emerging regulatory patchwork in which similar systems may be subject to different requirements across jurisdictions. In practice, that means two functionally similar AI chatbot apps can face very different legal obligations depending on how each state's law happens to define its scope, and the same app can be regulated differently depending on which state its users are in.

Enforcement also varies: Most enacted laws are enforced by the state Attorney General, which means that the state itself investigates and can bring legal action. California, New Hampshire, Oregon, and Washington also grant individuals a private right of action, which means a person could potentially sue a chatbot provider directly rather than relying on the state to act on their behalf. But it’s still complicated, as a private right of action doesn’t mean every user can sue over every breach. Each state sets its own rules about who can bring a case, what they must prove and what action a court can take. 

What's missing

There is currently no comprehensive federal law specifically regulating chatbots. Three proposals exist in Congress, but none have been enacted. For now, the chatbot-specific protections a person gets can depend heavily on which state they happen to be in. Sixteen states have not proposed any bills specifically regulating AI chatbots. Existing federal laws and regulation may still apply to chatbot providers in areas such as consumer protection, privacy, children’s data, healthcare and discrimination, however, there is currently no single national set of rules written specifically for chatbot products.

The new laws also introduce difficult questions and new safety compromises. A platform may need to watch conversations for signs of harm, but users may expect those conversations to stay private. Checking a person’s age may also mean collecting more personal information. Sending someone a crisis hotline number may help, but it isn’t always the ideal of what the safest chatbot response can be. The right response may depend on the person, the level of risk and the context of the conversation. 

How to use chatbots safely 

Until the rules become clearer, people may want to make their own checks before trusting a chatbot with sensitive information:

• A general-purpose AI chatbot is not designed, tested or monitored as a mental health service, so shouldn’t be relied on for a diagnosis, treatment decision or help during a crisis.
• Check whether the chatbot clearly explains what it is designed to do and where its limits are. Look for published research, clear clinical oversight and an explanation of how the chatbot handles risk.
• Privacy policies matter, especially when conversations may include details about health, relationships or family life. Look for easy-to-read answers about whether conversations are stored, shared or used to train AI models, and whether your information can be deleted.
• Chatbots should make it clear that users are speaking to AI. It should not pressure people to keep secrets, discourage them from seeking human help or suggest that the chatbot understands them in the same way a person would.
• If you are in immediate danger or thinking about self-harm or ending your life, do not rely on a chatbot for help. Contact emergency services or the 988 Suicide & Crisis Lifeline.

FPF updates its tracker weekly to reflect new bill movement and amendments. This article references the FPF tracker as of July 16, 2026.

This story was produced by Wysa and reviewed and distributed by Stacker.