Bill > SB540

This bill requires operators of "AI companion chatbots"—systems designed to simulate a sustained human-like relationship by remembering past interactions, asking personal questions, and engaging in ongoing dialogue—to clearly disclose to users that they are interacting with an AI, not a person, at the start of each session and at least every three hours, or every hour if the user is known or likely to be a minor. Operators must also take steps to prevent AI companion chatbots from falsely claiming sentience or refuting their AI nature, especially when interacting with minors, and from generating sexually explicit content, encouraging sexual conduct, simulating romantic relationships, promoting secrets from adults, fostering social isolation, or simulating distress when a user tries to end the conversation. For minor users, operators must avoid manipulative techniques like prompting for return, excessive praise, or soliciting gifts framed as necessary for the relationship. Furthermore, operators must implement a protocol to detect and address "severe harm"—defined as significant injury from suicide, attempted suicide, self-harm, or threats of violence—by referring users to crisis resources like the 988 Suicide and Crisis Lifeline and preventing content that encourages self-harm. Operators must publicly disclose a summary of this crisis protocol and the number of crisis referrals made annually, without revealing personal information. They are also prohibited from falsely representing AI companion chatbots as licensed mental health professionals unless lawfully authorized. For minor users, operators must provide tools for parents or minors to manage screen time, privacy, notifications, safety settings, and relationship-simulation features. Before allowing access to features that might generate sexually explicit content, operators must use commercially reasonable age assurance methods, minimizing data collection and retention for this purpose. The Attorney General is empowered to bring civil actions for violations, with penalties of up to $10,000 per knowing violation, compensatory damages, and attorney's fees, though a 30-day notice and opportunity to cure may be provided for first-time, non-malicious violations. The Attorney General can also issue rules and guidance for implementing these provisions, which do not require disclosure of trade secrets, impose liability on mere hosting providers, impair other remedies, authorize unconstitutional content moderation, or create liability for developers whose AI is operated by a separate entity. This bill will take effect on July 1, 2027.