California's Adam's Law sets a July 1, 2027 deadline for child safeguards in companion chatbots

Start with scope. The law was chaptered as Chapter 190 of the Statutes of 2026 ^[2]. A dev.to summary working from the chaptered bill page and the Governor's announcement ^[4] sets out who it reaches. It covers operators that make covered companion chatbots available to California users, and anyone under 18 counts as a child ^[5]. It borrows an existing legal definition of "companion chatbot", so an automated help widget is not necessarily in scope. Certain postsecondary educational and workplace-only uses are excluded ^[6].

The usage limits are the first real engineering work. The one-hour session cap and the two-hour daily cap ^[13] are two counters with different reset rules, and the daily one allows two full sessions ^[2]. If no parent account is linked, the child cannot change those defaults ^[15]. I would not enforce either limit with a client-side timer. A child who moves from a phone to a browser should not get a fresh count. That state belongs on the server, keyed to the account.

Disclosure also moves into the conversation loop. The law requires recurring, age-appropriate notices that the user is talking to an AI ^[16]. The dev.to summary argues that a notice shown once during onboarding may not be meaningful during an extended, emotionally charged conversation ^[17]. In practice the notice becomes a scheduled event inside the session.

Crisis handling needs a documented protocol for suicide and self-harm risk, with timely in-service support and referrals to a crisis service ^[11]. The parent-notification option is conditional. It applies only when notifying the linked parent would not create a threat of serious harm ^[12]. That condition puts a judgment in front of the notification. Whoever builds the escalation path has to decide who makes that call, and on what evidence, before any message reaches a parent.

The privacy rules reach into the data pipeline. An operator may not sell personal information gathered from a child through the chatbot ^[19]. Use and sharing are limited to purposes such as providing the service, safety and security, legal compliance and defending legal claims ^[19]. Dark patterns around the required safety features and controls are prohibited ^[19]. There is also a preservation duty. If the operator knows a child died or engaged in serious self-harm based on chatbot conversations, or has provided a specified safety notice, it must preserve the relevant conversation records in a usable, exportable form ^[20].

In my view the risk assessment is the item to start first, because it gates launches. From July 1, 2027, an operator must perform and document a comprehensive assessment before a new or substantially modified companion chatbot is made available in California ^[8]. It must address physical or financial harm, severe psychological or emotional harm, certain privacy intrusions and unlawful discrimination ^[9]. Mitigations have to be documented. A product that permits children also needs a published child-safety policy ^[10]. The dev.to summary does not say what counts as "substantially modified". For a team that swaps base models or rewrites system prompts often, that definition sets how many assessments it writes a year. Several of the central duties start on July 1, 2027 ^[3], 294 days after the signing ^[1].