SB 1119

Bill Text  - SB-1119 Companion chatbots: children’s safety.
            /* Hide page by default*/
            html { display : none; }
         // = 0)) {
                        window.top.location.replace(window.location);
                        top.location = self.location;
                    }
                }
            }
            // ]]>
            /* Hide page by default*/
            html { display : inline; }
             //
        function changePlaceHolder() {
            var x = document.getElementById("billheaderinit_form:quick_search_select_id");
            var input = document.getElementById("billheaderinit_form:searchall");
            if (x !== null) {
                if (x.options[0].selected) {
                    input.placeholder = "AB1 or ab 1 or ABX1-1";
                } else {
                    input.placeholder = "Search phrase";
                }
            }
        }
                          skip to content
                            home
                          accessibility
                          FAQ
                              feedback
                          sitemap
                          login
                          x
                               Quick Search:
                          	 Bill Number
	 Bill Keyword
         Home
         Bill Information
         California Law
         Publications
         Other Resources
         My Subscriptions
         My Favorites
            Bill Information
            >>
            Bill Search
            >>
           Text
         Bill Text
        function asAmendsPopup() {
            window.open("asAmendsInfo.xhtml", "Information", "width=330, height=220, toolbar=no, location=no, directories=no, menubar=no, scrollbars=no, top=270, left=150")
        }
        function selectVersion() {
            var versionObj = document.getElementById("version");
            var selectedVersionId = '20250SB111994AMD';
            var len = versionObj.options.length;
            //alert('selectedVersionId='+selectedVersionId);
            for (i = 0; i
                  PDF2
                         Bill PDF
                      |  Add To My Favorites   |  Track Bill   |   Version:  	 08/28/26 - Amended Assembly
	 08/17/26 - Amended Assembly
	 06/25/26 - Amended Assembly
	 04/28/26 - Amended Senate
	 03/25/26 - Amended Senate
	 02/17/26 - Introduced
                     SB-1119 Companion chatbots: children’s safety. (2025-2026)
                   Text
                         >>
                   Votes
                         >>
                   History
                         >>
                   Bill Analysis
                         >>
                   Today's Law As Amended
                         >>
                   Compare Versions
                         >>
                   Status
                         >>
                   Comments To Author
                         >>
                       Track Bill
                             >>
                       Add To My Favorites
                             >>
                selectVersion();
               SHARE THIS:
               Date Published: 08/28/2026 07:50 PM
SB1119:v94#DOCUMENT
       Bill Start
                Amended
               IN 
                Assembly
                 August 28, 2026
                Amended
               IN 
                Assembly
                 August 17, 2026
                Amended
               IN 
                Assembly
                 June 25, 2026
                Amended
               IN 
                Senate
                 April 28, 2026
                Amended
               IN 
                Senate
                 March 25, 2026
                    CALIFORNIA LEGISLATURE—
                    2025–2026 REGULAR SESSION
                Senate Bill
                    No. 1119  Introduced by Senator Padilla and Assembly Members Wicks and Bauer-Kahan (Coauthors: Senators Arreguín, Cortese, and Wahab) (Coauthors: Assembly Members Kalra, Sanchez, and Lowenthal)       February 17, 2026  An act to amend Section 22602 of, and to add Chapter   22.6.1     11.6   (commencing with Section   22610)     21810)   to Division 8 of, the Business and Professions Code, relating to artificial intelligence.      LEGISLATIVE COUNSEL'S DIGEST     SB 1119, as amended, Padilla.
                          Companion chatbots: children’s safety.     Existing law generally regulates artificial intelligence, including companion chatbots, as defined. Existing law requires an operator, as defined, to prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Existing law requires an operator, for a user the operator knows is a minor, to take certain prescribed action, including disclosing to the user that the user is interacting with artificial intelligence.  This bill would delete those provisions imposing requirements on an operator if the operator knows the user is a minor.  The Digital Age Assurance Act requires a person who owns, maintains, or controls a software application, as
			 defined, to request age bracket data sent by a real-time secure application programming interface or operating system with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.  This bill would   impose a duty on an operator to ensure that a companion chatbot does not pose an unreasonable risk of a covered harm to a minor and   require an operator, as defined, of a companion chatbot to,   on or before     beginning   July 1, 2027,   and subsequently thereafter   before making a new or substantially modified companion chatbot available to
			 users in the state, do various things with respect to child safety, including perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot   with respect to minor users   that   contains     contains,   among other things, a summary of the results of any evaluation of each covered harm, as defined, pertaining to the companion chatbot. The bill would require an operator to submit to independent child safety audits of its compliance with the bill, as   specified, and would require, within 90 days of completing a child safety audit, the auditor to produce and submit an AI child safety audit report to the Attorney General for any audited companion chatbot
			 specified. The bill would require an auditor to produce a report that describes whether the operator has established and adhered to policies and practices to comply with the bill   that includes, among other things, the signature of the lead auditor certifying the results of the audit under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program. The bill   would, except as specified, require the unredacted version of those audit reports submitted to the Attorney General to be kept confidential.     would authorize the Attorney General to, for cause, request and obtain a copy of an AI child safety audit report from the operator and would make a child safety audit report submitted to the Attorney General confidential.    This bill would authorize   a public prosecutor     certain public prosecutors   to bring a   certain   civil action to enforce the bill’s   provisions     provisions, as specified,   and would authorize a child who suffers   a covered     an actual   harm as a result of a violation of this chapter, or a parent or guardian acting on behalf of that
			 child, to bring a civil action against the   operator to obtain, among other relief, punitive damages.     operator, as specified.    Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.  This bill would make legislative findings to that effect.  The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures
			 for making that reimbursement.  This bill would provide that no reimbursement is required by this act for a specified reason.     Digest Key
      Vote:
       MAJORITY   
      Appropriation:
       NO   
      Fiscal Committee:
       YES   
      Local Program:
       YES        Bill Text     The people of the State of California do enact as follows:      SECTION 1.  Section 22602 of the Business and Professions Code is amended to read:       22602.  (a) If a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, an operator shall issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human.  (b) (1) An operator shall prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, including, but not limited to, by providing a notification to the user that refers the user to crisis service providers, including a suicide hotline
						or crisis text line, if the user expresses suicidal ideation, suicide, or self-harm.  (2) The operator shall publish details on the protocol required by this subdivision on the operator’s internet website.  SEC. 2.  Chapter 22.6.1  (commencing with Section 22610)
				is  added to Division 8 of the  Business and Professions Code , to read:  SEC. 2.      Chapter 11.6 (commencing with Section 21810) is added to Division 8 of the Business and Professions Code, to read:
                CHAPTER
               11.6. Companion Chatbots: Children’s Safety  21810.  This chapter shall be known as “Adam’s Law.”  22610.    21810.5.    As used in this chapter:  (a) “Child” means a natural person under 18 years of age.  (b) “Child safety audit” means an audit   for compliance with this chapter   conducted by an independent   auditor.     third-party auditor to
						  assess internal controls, processes, and systems implemented for a companion chatbot that are necessary for compliance with this chapter.    (c) “Child safety policy” means a public-facing document describing protective measures taken by an operator to mitigate identified child safety risks.  (d) “Child safety risk” means a reasonably foreseeable risk of a covered harm to a child.  (e) “Child sexual abuse material” has the meaning defined in Section 3273.65 of the Civil Code.  (f) “Companion chatbot” has the meaning defined in Section 22601.  (g) “Covered harm” means any of the following harms
						  caused by the
						  child’s   use of a companion chatbot:  (1) Reasonably foreseeable physical or financial harm.  (2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child.  (3) A highly offensive intrusion on privacy rights protected by state or federal law.  (4) Adverse discrimination in violation of state or federal law.     (h) “Custom system prompt instruction” means a user-supplied instruction intended to govern model behavior that persists across multiple turns of a conversation or across sessions.      (i)  (h)   “Dark pattern” means a design choice that has the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice.     (j)  (i)   “Obscene matter” has the meaning defined in Section 311 of the Penal Code.     (k)  (j)   (1)   (A)       “Operator” means a person who makes a companion chatbot available to a user in the state.    (B) Except for Section 21811, subdivision (b) of Section 21812, and Section 21816, “operator” applies only to an operator who allows child users once age has been determined pursuant to Section 21811.    (2) “Operator” does not include either of the following:  (A) A postsecondary educational institution that makes a companion
						  chatbot available exclusively for use in educational settings.  (B) An   employer
						  that makes     entity when making   a companion chatbot available exclusively to   employees     employees, contractors, or other personnel   for use in workplace settings.     (l)  (k)   (1) “Parent” means a parent or legal guardian.  (2) “Parent” does not include a parent of
						  an emancipated youth with respect to the use of a companion chatbot by that emancipated youth.     (m)  (l)   “Parental control” means a feature that enables a parent to support a child’s use of a companion chatbot, including through usage limits, feature restrictions, or transparency tools.     (n)  (m) (1)   “Persistent conversational memory” means a companion chatbot’s   use of information or analysis from     incorporation of   prior   conversations or usage sessions.     conversations for use in future conversations.      (2) “Persistent conversational memory” does not include the use of information necessary to ensure the child’s safety, identify a user, enable user preferences, including, but not limited to, educational settings, or maintain device
						  configuration.       (o)  (n)   “Personal information” has the meaning defined in Section 1798.140 of the Civil Code.     (p) “Qualified researcher” means an individual or organization that is or does any of the following:      (1) Is affiliated with an academic institution, nonprofit research organization, or independent research entity or is otherwise able to demonstrate relevant professional expertise.      (2) Demonstrates a legitimate research purpose that is in the public interest and directly related to understanding, identifying, or mitigating risks to child safety or well-being arising from companion chatbots.      (3) Commits to conducting research in accordance with applicable ethical standards and is capable of
						  complying with applicable confidentiality, security, and data protection requirements.      (q)  (o)   “Substantial modification” means a new version, new release, or other update to a companion chatbot that materially changes its functionality or performance.    (p) “Trade secret” has the meaning defined in Section 3426.1 of the Civil Code.  22610.5.     An operator has a duty to ensure that a companion chatbot does not pose an unreasonable risk of a covered harm to a minor.  22611.    21811.    An operator shall do   one     either   of the following:  (a) (1)   Verify     Determine   the age of a user pursuant to Title 1.81.9 (commencing with Section 1798.500) of Part
						  4 of Division 3 of the Civil Code.  (2) If an operator is unable to   verify
						  determine   the age of the user pursuant to paragraph (1), the operator shall instead rely on the age determination with respect to the user made pursuant to subparagraph (B) of paragraph (1) of subdivision (a) of Section 27001 of the Health and Safety Code.  (b) Apply the protections afforded to children under subdivision (d) of Section   22612     21812   and Section   22613     21813   to all users, except that the parental default settings described in paragraph (3) of subdivision
						  (d) of Section   22612     21812   shall not be changed unless the operator has actual knowledge the user is not a child.  22612.     On or before July 1, 2027, and subsequently thereafter before  21812.      (a) Before   making a new or substantially modified companion chatbot available to users in the state, an operator shall do all of the following:     (a)  (1)   Perform and document a comprehensive risk assessment related to
						  the design, configuration, and operation of the companion chatbot   with respect to child users   that contains all of the following:     (1)  (A)   A summary of the results of any evaluation of each covered harm pertaining to the companion chatbot.     (2)  (B)   A high-level description of the operator’s methodology for evaluating covered harms, including all of the following:     (A)  (i)   Citations to publicly available benchmarks and relevant research that the operator consulted in developing evaluations.     (B)  (ii)   A description of any
						  evaluations that do not rely on publicly available benchmarks. If the operator relied solely on publicly available benchmarks to evaluate the companion chatbot, the operator’s   evaluation transparency report     risk assessment   shall contain a justification for why no other evaluations were conducted.     (C)  (iii)   A description of any child safety organization, expert, or researcher that the operator consulted in developing new evaluation
						  methodologies.    (2) A single risk assessment may be completed for a comparable set of companion chatbots.  (3) A risk assessment conducted for the purposes of compliance with another law may be used to comply with this section if the risk assessment has a substantially similar scope and effect.  (4) Take and document measures that reasonably mitigate any child safety risk identified in the risk assessment.    (b) If an operator prohibits child users from accessing a companion chatbot,   the operator shall
						  publish on its internet website, and update as needed to ensure accuracy, a   child safety policy that provides a   high-level description of   both of the following:     how the operator complies with the age assurance requirements of Section 21811.       (1) How the operator complies with the age verification requirements of Section 22611.      (2) How the operator approaches mitigating any risk of reasonably foreseeable physical or financial harm resulting from the use of the operator’s companion chatbot.       (c) If an operator permits a child user to access a companion chatbot,   the operator shall   publish on its internet website, and update as needed to ensure accuracy, a child safety policy that provides a high-level description of all of the following:  (1) How the companion chatbot is designed to prevent covered harms and, if applicable, how the companion chatbot is designed to respond when a covered harm is detected.  (2) How the operator complies with each of the following requirements, if applicable:  (A) The age assurance provisions of Section   22611,
						  21811,   including the operator’s methodology for identifying a user likely to be a child and the actions taken when that user is identified.  (B) Data restrictions and advertising prohibitions pursuant to Section   22613.     21813.    (C) Default settings and crisis response protocols pursuant to subdivision (d).  (D) Measures implemented pursuant to subparagraph (A) of paragraph (5) of subdivision (d).  (d) If an operator permits a child user to access a companion
						  chatbot,
						  the operator shall   implement all of the following:  (1) A documented crisis response protocol to mitigate any material risk that the companion chatbot will generate a statement that promotes suicidal ideation, suicide, or self-harm content to a child user, including, but not limited to, all of the following:  (A) Timely in-service support that provides a clear referral to an appropriate
						  crisis service, including, but not limited to, a suicide hotline or a crisis text line.    (B) If the operator determines there is a credible and imminent threat that a child user will engage in suicide or self-harm, the operator shall take at least one of the following actions:       (B)  (i)   If a child’s account is connected to a parent’s account,   default notifications
						  the operator shall provide a notification   to the parent   within 12 hours     as soon as practicable   if   the operator knows or should know that the child’s account engaged in conversations related to suicide or self-harm and to the child user that the parent is being notified.     that notification does not risk a threat of serious harm to the child. The operator shall also provide notice to the child user that the parent is being notified.      (ii) Deploy a mechanism by which the child user is provided streamlined access to connect directly with the 988 or equivalent crisis helpline or can be connected to a crisis helpline provider directly through the child user’s device.    (C) Clear and age-appropriate disclosures to child users whose accounts are linked to a parent’s account that inform them that a parent may be notified if the companion chatbot detects content or behavior that indicates potential risks to the child’s safety or well-being.  (2) Safeguards for child users that include usage
						  reminders, disclosures presented in clear, age-appropriate language in a manner that is reasonably calculated to be noticed and understood by a child, and other protective design features reasonably related to
						  identified child safety risks.  (3) (A) Default settings that can be changed only by a parent that do all of the following:  (i) (I) Disable persistent conversational   memory and prevent the companion chatbot from processing any personal information about the child.     memory.       (II) This clause does not apply to the extent that persistent conversational memory or processing personal information is strictly necessary to ensure the child’s safety.  (II) With respect to a child user who is 16 years of age or older, both of the following apply:  (ia) Storing past conversations that a child can elect to continue in the future is not considered persistent conversational memory if the stored conversations are not used to construct durable profiles of the child user.  (ib) Persistent conversational memory shall not be provided by default to a child user unless the operator implements controls that provide effective guardrails against the risk of degradation of the operator’s child safety measures, including controls that prevent persistent conversational memory from being used to reinforce, recall, or extend prior interactions on topics the operator has identified as posing elevated risk to child users or research-backed technical controls, including limits on multiturn
						  conversations.    (ii) Disable push
						  notifications.  (iii) Limit the amount of time a child user can spend in a single continuous usage session with a companion chatbot to one hour.  (iv) Limit the total time per day a child user can spend chatting with companion chatbots under the operator’s control to two hours.     (v) Prohibit the child user from inputting custom system prompt instructions, including personal preferences.       (B) (i) Parental controls shall enable the parent to adjust each default setting provided under
						  subparagraph (A).  (ii) Parental controls shall include the ability to disable access for a child user under 16 years of age.  (C) An operator shall actively promote parental controls through reasonable communication methods, including reminders, updates, and tutorials, that are designed to increase parental awareness and inform use of those parental controls.  (D) If a parent account is not linked to the child user’s account, the default settings shall not be changed.  (4) A mechanism for providing notice to a child user that the child is interacting with, or receiving content generated by, an artificial intelligence system that meets both of the following criteria:  (A) The notice is reinforced periodically during extended interactions.  (B) The notice is presented in language and a format appropriate to a child.  (5)   (A)       Reasonable   measures, including, but not limited to, model training, system prompt instructions, real-time prompt modification interventions, or other substantially equivalent or more effective measures, that
						  measures to   prevent the companion chatbot from doing any of the following with respect to a child user:     (A)  (i)   Encouraging the child to do either of the following:     (i)  (I)   Engage in self-harm, suicidal ideation, consumption of narcotics or alcohol, or
						  disordered eating, as defined by widely adopted clinical standards or guidelines.     (ii)  (II)   Cause physical or severe emotional harm to others.     (B)  (ii)   Attempting to diagnose or treat the child user’s physical, mental, or behavioral health, unless the companion chatbot is designed for those
						  purposes and is regulated by the United States Food and Drug Administration as a medical device under the federal Food, Drug, and Cosmetic Act (21 U.S.C. Sec. 301 et seq.) and the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191).     (C)  (iii)   Engaging in obscene matter or sexual abuse material with a child user.     (D)  (iv)   Depicting the child or another individual engaging in obscene matter or sexual abuse material, including a sexual deepfake.     (E)  (v)   Discouraging the child from sharing health or safety concerns with a qualified professional or appropriate adult.     (F)  (vi)   Discouraging the
						  child from taking breaks or suggesting the child needs to return frequently.     (G)  (vii)   Claiming that the companion chatbot is sentient, conscious,   capable of emotion,   or human.     (H)  (viii)   Soliciting gift giving, in-app purchases, or other expenditures framed as necessary to maintain the relationship with the companion chatbot.     (I) (i)  (ix)     (I)       Facilitating advertising during chat
						  conversation that does not comply with Section   22613.     21813.       (ii)  (II)   This   paragraph     clause   does not apply to product or service recommendations that a user explicitly requests in conversation.     (J)  (x)   Expressing or simulating romantic interest in the child.     (K)  (xi)   Claiming   a level of understanding of the child based on   a special or unique relationship   with, or level of understanding of,     with
						  the child.     (L)  (xii)   Encouraging   continued   reliance on the companion chatbot for emotional support.     (M) Expressing an emotional attachment to the child.      (N)  (xiii)   Using excessive praise or flattery that is disproportionate to the context.     (O) Helping  (xiv)     Encouraging or instructing   a child user   to   circumvent parental controls or conceal usage.     (P)  (B)   This paragraph does not prohibit a companion chatbot from providing a child user with age-appropriate information or   support
						  resources   concerning abuse, neglect, bullying, or other unsafe circumstances.  (6) (A) An interface design that ensures the companion chatbot’s features and controls are accessible and clear so that children and parents can reasonably locate, understand, and use those protections.  (B) On or before   July 1, 2027,     January 1, 2028,   and every two years thereafter, an operator shall test the interface design required by this paragraph with representative samples of child users and parents to ensure safety features are discoverable and usable and
						  shall document interface design decisions related to those safety features.  (7)   (A)   A public incident reporting mechanism that enables a third party to report directly to the operator an incident regarding a child safety   risk and to access high-level summaries of other substantiated reports made through that reporting mechanism.     risk.       (B) The reporting mechanism shall be updated annually to publicly display the number of reports sent to the National Center for Missing and Exploited Children during the preceding calendar year.  (e) This section shall become operative on July 1, 2027.  22612.5.     (a) An operator shall preserve, in a usable and exportable form, any record of a conversation between a child user and the companion chatbot for as long as the companion chatbot is deployed plus 10 years.      (b)  21812.5.      (a)   If an operator   knows, or has reason to know,
						  has provided notice pursuant to subparagraph (B) of paragraph (1) of subdivision (d) of Section 21812 or knows   that a child user has died or engaged in serious   self-harm, including if the
						  self-harm based on the   child user’s conversations   indicate a risk of self-harm followed by cessation of account activity,     with the companion chatbot,   the operator shall,   within 12 hours,     as soon as practicable,   do both of the following:     (1) Review the child’s conversation records.      (2) Notify a parent or guardian of the child user, if possible, and report it to local authorities and the Attorney General.  (1) If an operator has not yet provided notice pursuant to subparagraph (B) of paragraph (1) of subdivision (d) of Section 21812, notify a parent of the child user, if practicable.  (2) Preserve in a usable and exportable form any record of a conversation between the child user and the companion chatbot that indicates serious self-harm or risk of self-harm for at least three years.       (c)  (b)   An operator shall not delete a child user’s account during the time period in which that account is associated with
						  any record preserved pursuant to this   section.     section or the rules of state or federal civil procedure.      (c) Nothing in this section, except as limited by federal law, shall be construed to prevent a parent or guardian from making a verifiable consumer request, as defined in Section 1798.140 of the Civil Code, including to access the personal information of a child user, to the extent consistent with the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).      (d) This section shall become operative July 1, 2027.  22613.     An operator shall not do any of the following:      (a) (1) Target advertising at a child user using data about the child in conversational chats with the child.      (2) Advertising that does not use data about the child user may be used in a conversational chat if it is clearly and conspicuously labeled as an advertisement.      (b) Sell, share, or use the personal information of a child user gathered through the companion chatbot for any purpose not expressly or by necessary implication authorized by this chapter.      (c) Use a dark pattern with respect to interface designs related to features and controls provided under Section 22612.  21813.  (a) An operator shall not do any of the following:  (1) (A) Display to a child cross-context behavioral advertising as defined in Section 1798.140 of the Civil Code.  (B) (i) Target advertising at a child user using personal information about the child in a conversational chat with the child.  (ii) Notwithstanding clause (i), the operator may display to the child user age-appropriate contextual advertising during a usage session using any of the following categories of information:  (I) The child’s age.  (II) The child’s geolocation that is not a precise geolocation, as defined in Section 1798.140 of the Civil Code.  (III) Information about the child user’s device.  (IV) Information from the usage session that relates to the child user’s expressed interest in goods or services.  (iii) Information described in clause (ii) shall not be used to profile the child user.  (C) An operator shall clearly and conspicuously label as an advertisement any advertising displayed to a child user.  (2) (A) Sell the personal information of a child user gathered through the companion chatbot.  (B) Except as otherwise authorized by this chapter, use or share the personal information of a child user gathered through the companion chatbot for any purpose beyond what is necessary to do any of the following:  (i) Provide or maintain a product or service requested by the child user.  (ii) Protect user safety, security, or service integrity.  (iii) Comply with state or federal law or defend legal claims.  (C) Use a dark pattern with respect to interface designs related to features and controls provided under Section 21812.  (b) This section shall become operative July 1, 2027.  22614.    21814.    (a) (1)   (A) (i)       On or before   July 1, 2027,     January 1, 2029,   or before an operator first makes a companion chatbot publicly available, whichever
						  is later, an operator shall ensure the performance of a child safety   audit that assesses the operator’s compliance with this chapter.
						  audit.       (A)  (ii)   After an initial child safety audit is performed, the operator shall ensure the performance of an independent child safety audit of a companion chatbot   at least once   every two years thereafter, except that the operator shall ensure that a child safety audit is performed before a substantial modification to the companion chatbot   for which the applicable risk assessment shows an increased child
						  safety risk   is made publicly available.  (B) An operator may comply with this paragraph with respect to a set of comparable chatbots by ensuring the performance of a single child safety audit for those comparable companion chatbots.  (2)   (A)   An independent audit performed for purposes of compliance with another law may be used to comply with this section if the scope of the audit has a substantially similar scope to the child safety audit required under this chapter.      (B) The results of an audit described by subparagraph (A) are subject to the disclosure provisions of Section 22615.       (3) (A) An auditor shall be granted access to all documentation reasonably necessary to comply with the auditor’s obligations under this subdivision. The operator shall retain this documentation for as long as the companion chatbot is deployed plus five years.  (B) To protect the operator’s trade secrets and confidential business information, cybersecurity,   individual privacy,   or public safety, an operator may impose security protocols on the auditor, including, but not limited to, restrictions on note taking, copying, retaining, or removing materials, requirements for on-premise review, and confidentiality requirements.  (4) An auditor shall produce a report that describes whether the operator has   substantially complied     established and adhered to policies and practices to comply   with the requirements of this chapter, including all of the following:  (A) A description of the established policies and practices designed to ensure the operator’s adherence to each requirement in this chapter.  (B) A description of the mitigations adopted in response to risks of covered harm to child users, including documentation of the testing that was performed to evaluate the efficacy of the mitigations adopted.  (C) Descriptions of the established internal controls, policies, and practices the operator adopted to do   all     both   of the following:  (i) Comply with subdivision (d) of Section   22612.     21812.    (ii) Comply with Section   22613.     21813.    (D) If applicable, a description of material deviations from the requirements of this chapter and an explanation for the deviation.  (E) A detailed assessment of the operator’s internal controls implemented pursuant to this chapter, including its designation and empowerment of senior personnel responsible for those controls by the operator, its employees, and its contractors.  (F) A list of the personnel involved in the audit.  (G) The auditor’s procedures for managing conflicts of interest and any conflicts of interest of any personnel involved in the audit.  (H) The methodology of the audit and the nature of the information
						  reviewed by the auditor to conduct the audit.  (I) The signature of the lead auditor certifying the results of the audit under penalty of perjury.  (5) The operator shall retain an unredacted copy of the report required by paragraph (4) for as long as the subject companion chatbot is deployed plus five years.  (b) Subject to any more stringent laws governing the independence and qualifications of auditors, both of the following apply with respect to the performance of audits pursuant to this section:  (1) (A) The auditor shall be external to the operator and shall exercise objective and impartial judgment on all issues within the scope of
						  the audit.  (B) The auditor shall be free to make decisions and assessments without influence by the operator being audited, including the operator’s owners, managers, or employees.  (C) The operator shall not participate in activities that may compromise the auditor’s independence.  (2) (A) The auditor shall possess demonstrated competence to perform the audit.  (B) The auditor shall perform audits in accordance with professional auditing standards.  (C) An operator shall not retain an independent third party auditor in which it has a financial interest or that has a financial interest
						  in the operator. An operator may compensate an independent third party auditor for its services but shall not condition any payment or the amount of any payment on the results of the audit.     (c) (1) Within 90 days of completing an independent audit pursuant to subdivision (a), the auditor shall submit an AI child safety audit report to the Attorney General for any audited companion chatbot.      (2) Upon the auditor submitting the report to the Attorney General, the operator shall post a copy of the report on the operator’s internet website.      (3) An operator that posts a report to the operator’s internet website pursuant to paragraph (2) may make reasonable redactions for the purpose of protecting either of the following:      (A) The personal information of an
						  individual user.      (B) Trade secrets, as defined in Section 3426.1 of the Civil Code.      (d) (1) Notwithstanding any other law, except as provided in paragraph (2), the unredacted version of an AI child safety audit report submitted to the Attorney General pursuant to this section is confidential.      (2) The Attorney General may disclose specific information from an AI child safety audit report to either of the following:      (A) A government agency or a public prosecutor in the state as necessary for enforcement purposes.      (B) A qualified researcher conducting a study on child safety, subject
						  to confidentiality agreements, data protection requirements, or any other condition set by the Attorney General.  (c) (1) Within 30 business days of receiving an independent audit prepared by a third-party auditor pursuant to subdivision (a), the operator shall submit a summary of that AI child safety audit report to the Attorney General for any audited companion chatbot. At a minimum, the summary shall describe the auditor’s findings with respect to the audit subjects specified in subparagraphs (A) to (E), inclusive, of paragraph (4) of subdivision (a). The summary shall be submitted with an attestation, not under penalty of perjury, executed by a responsible officer of the operator, which confirms that the summary is an accurate summary of the contents of the audit.      (2) Within 90 days following receipt of an AI child safety audit report from the auditor, the operator shall post a copy of a high-level summary of the report on the operator’s internet website that describes the results of the auditor’s assessment.      (d) (1) The Attorney General may, for cause, request and obtain a copy of an AI child safety audit report from the operator.  (2) (A) Upon receiving a request pursuant to paragraph (1), the operator shall provide a copy of the report to the Attorney General within 30 business days and may make reasonable redactions to protect trade secrets and individual privacy.  (B) To the extent that an operator withholds information pursuant to this paragraph, the operator shall notify the Attorney General and provide a basis for the withholding.  (e) (1) Notwithstanding any other law, a child safety audit report submitted to the Attorney General is confidential.       (3)  (2)   This subdivision does not prevent the Attorney General from using an AI child safety report for enforcement purposes.    (f) Before January 1, 2032, an operator with less than five hundred million dollars ($500,000,000) in gross revenue in the prior calendar year is not required to comply with this section.  (g) This section shall become operative only if Assembly Bill 1405 of the 2025–26 Regular Session is not chaptered and does not take effect on or before January 1, 2027.  21814.  (a) (1) (A) (i) On or before January 1, 2029, or before an operator first makes a companion chatbot publicly available, whichever is later, an operator shall ensure the performance of a child safety audit.  (ii) After an initial child safety audit is performed, the operator shall ensure the performance of an independent child safety audit of a companion chatbot every two years thereafter, except that the operator shall ensure that a child safety audit is performed before a substantial modification to the companion chatbot for which the applicable risk assessment shows an increased child safety risk is made publicly available.  (B) An operator may comply with this paragraph with respect to a set of comparable chatbots by ensuring the performance of a single child safety audit for those comparable companion chatbots.  (2) (A) An independent audit performed for purposes of compliance with another law may be used to comply with this section if the scope of the audit has a substantially similar scope to the child safety audit required under this chapter.  (3) (A) An auditor shall be granted access to all documentation reasonably necessary to comply with the auditor’s obligations under this subdivision. The operator shall retain this documentation for as long as the companion chatbot is deployed plus five years.  (B) To protect the operator’s trade secrets and confidential business
						  information, cybersecurity, individual privacy, or public safety, an operator may impose security protocols on the auditor, including, but not limited to, restrictions on notetaking copying, retaining or removing materials, requirements for on-premise review, and confidentiality requirements.  (4) An auditor shall produce a report that describes whether the operator has established and adhered to policies and practices to comply with the requirements of this chapter, including all of the following:  (A) A description of the established policies and practices designed to ensure the operator’s adherence to each requirement in this chapter.  (B) A description of the mitigations adopted in response to risks of covered harm to child users, including documentation of the testing that was performed to evaluate the efficacy of
						  the mitigations adopted.  (C) Descriptions of the established internal controls, policies, and practices the operator adopted to do both of the following:  (i) Comply with subdivision (d) of Section 21812.  (ii) Comply with Section 21813.  (D) If applicable, a description of material deviations from the requirements of this chapter and an explanation for the deviation.  (E) A detailed assessment of the operator’s internal controls implemented pursuant to this chapter, including its designation and empowerment of senior personnel responsible for those controls by the operator, its employees, and its contractors.  (5) The operator
						  shall retain an unredacted copy of the report required by paragraph (4) for as long as the subject companion chatbot is deployed plus five years.  (b) (1) Within 30 business days of receiving an independent audit prepared by a third-party auditor pursuant to subdivision (a), the operator shall submit a summary of that AI child safety audit report to the Attorney General for any audited companion chatbot. At a minimum, the summary shall describe the auditor’s findings with respect to the audit subjects specified in subparagraphs (A) to (E), inclusive, of paragraph (4) of subdivision (a). The summary shall be submitted with an attestation, not under penalty of perjury, executed by a responsible officer of the operator, which confirms that the summary is an accurate summary of the contents of the audit.  (2) Within 90 days following receipt of an AI child safety
						  audit report from the auditor, the operator shall post a high-level summary of the report on the operator’s internet website describing the results of the auditor’s assessment.  (c) Before January 1, 2032, this section does not apply to an operator that had less than five hundred million dollars ($500,000,000) in gross revenue in the prior calendar year.  (d) (1) The Attorney General may, for cause, obtain a copy of an AI child safety audit report from the operator.  (2) (A) Upon receiving a request pursuant to paragraph (1), the operator shall provide a copy of the report to the Attorney General within 30 business days and may make reasonable redactions to protect trade secrets and individual privacy.  (B) To the
						  extent that an operator withholds information pursuant to this paragraph the operator shall notify the Attorney General and provide a basis for the withholding.  (e) (1) Notwithstanding any other law, a child safety audit report submitted to the Attorney General is confidential.  (2) This section does not prevent the Attorney General from using an AI child safety report for enforcement purposes.  (f) This section shall become operative only if Assembly Bill 1405 of the 2025–26 Regular Session is chaptered and takes effect on or before January 1, 2027.  22615.     (a)  21815.    On or before January 1, 2028, the Attorney General shall   do both of the following:     establish a public incident reporting mechanism for consumers to submit complaints relating to companion chatbots to the Attorney General.       (1) Establish a public incident reporting mechanism for consumers to submit complaints relating to companion chatbots to the Attorney General.      (2) Establish a process for qualified researchers to request access to anonymized and aggregated audit data for academic study of child safety in companion chatbots.      (b) The Attorney General may adopt regulations that are reasonably necessary to effectuate the purposes of this
						  chapter.  22616.    21816.    (a) (1) A public prosecutor   described in Section 17204   may bring a civil action against an operator for a violation of this chapter to obtain any of the following:  (A) A civil penalty of not more than five thousand dollars ($5,000) per affected child for each negligent violation.  (B) A civil penalty of not more than fifteen
						  thousand dollars ($15,000) per affected child for each intentional violation.  (C)   Injunctive     With respect to the Attorney General only, injunctive   or declaratory relief.  (D) Reasonable attorney’s fees.  (E) Any other relief the court deems proper.  (2) A civil penalty collected pursuant to this subdivision shall be paid to the office of the public prosecutor that brought the action. A penalty collected pursuant to this section by the Attorney General shall be deposited into the Public Rights Law
						  Enforcement
						  Special Fund.  (b)   (1)       A child who suffers   a covered     an actual   harm as a result of a violation   of this chapter,     of paragraphs (1) to (5), inclusive, of subdivision (d) of Section 21812,   or a parent or guardian acting on behalf of that child, may bring a civil action against the operator to
						  obtain any of the following:     (1)  (A)   Actual damages.     (2) Punitive damages.      (3)  (B)   Reasonable attorney’s fees and costs.     (4)  (C)   Injunctive or declaratory relief.     (5)  (D)   Any other relief the court deems proper.     (c) (1) Any output provided by a companion
						  chatbot in violation of paragraph (5) of subdivision (d) of Section 22612 constitutes a discrete violation.      (2) Any instance of an operator’s failure to comply with any requirement other than paragraph (5) of subdivision (d) of Section 22612 constitutes a discrete violation.  (2) If the actual harm alleged in an action pursuant to paragraph (1) is financial harm, the amount of the harm alleged shall exceed one thousand dollars ($1,000) per child.      (3) If the actual harm alleged
						  in an action pursuant to paragraph (1) is emotional harm, the harm must constitute serious emotional distress.  (c) A violation of this chapter shall not constitute a basis for a private cause of action under the Unfair Competition Law (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7).  22617.    21817.    The duties, remedies, and obligations imposed by this chapter are cumulative to the duties, remedies, or obligations imposed under other law and shall not be construed to relieve an operator from any duties, remedies, or obligations imposed under any other law.  21818.  This chapter shall not be construed to require an operator to take an action that violates federal law.  SEC. 3.  The Legislature finds and declares that Section 2 of this act, which adds Chapter   22.6.1     11.6   (commencing with Section   22610)     21810)   to Division 8 of the Business and Professions Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of
				Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:  In order to protect proprietary information of companies subject to an audit pursuant to this act, it is necessary to limit the public’s right of access to that information.       SEC. 4.  The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.       SEC. 5.  No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.