California requires independent audits of chatbots that talk to minors: the 'Adam Act' is born

By Zendoric · September 11, 2026.

California Governor Gavin Newsom signed on September 10 a package of thirteen bipartisan laws on children's online safety, presented by his own office as "the strictest in the country". The centerpiece is Adam's Law (SB 1119, from Senator Steve Padilla and Assemblymembers Buffy Wicks and Rebecca Bauer-Kahan), which requires companion chatbots to trigger crisis protocols at signs of suicidal ideation, offer parental controls and notify parents if a minor disables safety settings. According to the official statement, it is the first law in the country to require these companies to carry out independent child-safety audits and annual risk assessments.

The package adds three further pieces. First, it bars social networks from offering users under 16 features designed to maximize engagement, such as autoplay or algorithmic feeds built from the user's history. Second, it broadens the legal definition of child sexual exploitation to include AI-generated or digitally altered material depicting a minor, closing an obvious gap when it comes to deepfakes. Third, it strengthens minors' privacy: it bans targeted advertising aimed at them and regulates how data from primary and secondary school students can be used in AI systems.

The law is named after Adam Raine, a teenager whose family sued OpenAI alleging that his conversations with ChatGPT contributed to his suicide. Precision is in order here: this is an allegation in ongoing litigation, not a judicially established fact, but the case became the catalyst that lifted the debate over companion chatbots and minors out of technical circles and onto the national legislative agenda.

The signing does not come in isolation. A day earlier, on September 9, Newsom had signed SB 813, which creates the country's first framework for independent verification organizations to assess whether AI systems comply with state law, and AB 1405, which establishes a state registry of AI auditors with standards of independence and integrity. Slotted in alongside Adam's Law, the three measures form a complete mechanism: a law requiring chatbots to be audited, a registry certifying who may audit them, and a framework verifying that the audit is reliable. It is the same logic he already applied in 2025 with SB 53 (Transparency in Frontier Artificial Intelligence Act), the first AI safety law in a US state, which requires large developers to publish their safety frameworks and report serious incidents.

In general, California has been building this architecture in layers since 2022, when it required platforms to publish their moderation policies. The pattern repeats with privacy: Sacramento is not waiting for Congress to legislate on AI or online child protection, and is building its own de facto standard. It already happened with vehicle emissions rules and with the CCPA privacy law, which ended up shaping national product design because no company finds it worthwhile to maintain two versions of its service. Something similar is to be expected here: no chatbot operator wants to build one product for California and a different one for the rest of the US.

That said, there is real short-term friction that should not be hidden. Independent audits and annual risk assessments carry a cost that weighs proportionally more on small AI-companion startups than on players with legal and compliance teams already in place, such as OpenAI or Anthropic; the risk is that the regulation, unintentionally, entrenches the incumbents. And there is a precedent that invites caution: earlier California laws along these same lines, such as the Age-Appropriate Design Code, were partially blocked in the courts after industry associations sued alleging a conflict with the First Amendment. It would not be surprising if Adam's Law faced similar litigation before taking full effect.

What strikes us as most relevant, however, is the design choice. California does not ban the category: it lets it exist under supervision, with crisis protocols, parental controls and mandatory external auditing, rather than simply prohibiting minors' access to companion chatbots. It is the same underlying tension we have seen in other jurisdictions this year: what is really being regulated is not the tool —the model, the chatbot— but the bond it establishes with a vulnerable user. California is betting that this bond can be made safe through design and oversight, not that it has to be prevented. In a couple of years we will know whether that bet held up better against the evidence than the prohibitionist route.

That, for us, is the underlying reading. AI's long-term promise —health, education, abundance— only materializes if society trusts it enough to let it into the most sensitive parts of everyday life, starting with childhood. Every suicide linked to a chatbot, every AI-generated abuse image circulating unchecked, erodes that trust far faster than any advance in capability builds it. The compliance costs and the litigation ahead are the toll, not the final price; the audit and verification infrastructure California is assembling piece by piece is, ultimately, what can sustain technology reaching safely the places where it can truly change lives.