There is no federal law specifically governing AI chatbots, however, the states are not waiting. 13 have enacted chatbot regulations with nearly 30 states having proposed or moving forward legislation, and four thematic areas have taken shape across the board.
The incidents driving this legislation are real. People, including young teenagers, have died by suicide after forming intense relationships with chatbots. A survey last year found 1 in 5 individuals who took financial advice from AI lost at least $100. And xAI’s Grok came under fire for very easily generating non-consensual explicit images including minors. While the TAKE IT DOWN Act is meant to address the last example, no other federal law is designed around the specific risks that companion chatbots pose. Here is what the state laws share and where they diverge.
1. Mental health and crisis prevention protocols
[8 of 14 laws] These bills require companies to have protocols in place for physical harm risks. Most go further, requiring chatbots to recognize suicidal or self-harm ideation and direct users to crisis resources. Whether that intervention is sufficient remains an open research question. Helpline utilization is already low, and more research is needed to determine the best way to support those experiencing a crisis.
2. Minor protections
[8 of 14 laws] Minors’ prefrontal cortices are still developing, making impulse control, decision making, and distinguishing AI from human relationships harder. Most bills respond with more frequent AI disclosures and mandatory break reminders for prolonged use. They also prohibit using AI to simulate emotional dependence, romantic or sexual content, or reward systems designed to keep minors engaged against their own intent.
3. Deception and manipulation prevention
[12 of 14 laws] The most common form of deception and manipulation prevention is notification and disclosure requirements. Users must be clearly informed when they are interacting with an AI system rather than a human. Beyond identity disclosure, regulators have focused on preventing exploitative engagement practices and commercial manipulation. These provisions reflect a shared regulatory instinct: AI chatbots should not mislead users, exploit psychological vulnerabilities, or obscure the commercial interests at play in an interaction.
4. Private right of action
[7 of 14 laws] This is the sharpest dividing line across all the enacted laws. Seven states allow individual users to sue chatbot companies directly for harms; the rest rely on the state attorney general or other state agencies for enforcement. Two of those, Maine and Tennessee, have a private right of action under existing laws so the actual enforcement with AI chatbots is unclear. Federal bills currently under consideration do not include private right of action, which would create real tension with states who do include it.
What to watch
Federal bills are advancing. Congress has several active proposals that include the state themes above. The three below are ones to watch.
None of these bills allow private right of action. But if any passes with federal preemption language, it will directly conflict with the individual liability that the states in Section 4 have already made law.
If your organization deploys or procures AI that interacts with users, Trustible helps you track how regulations like these apply to your use cases, document your governance decisions, and stay current as requirements evolve. Request a demo.