California puts a child safety risk assessment in front of every companion chatbot release

A 15-year-old switching off a safety setting is now an event a companion app owes a parent. Adam's Law requires parental controls and notification when a child disables safety settings, according to the governor's office ^[3]. Someone has to own that toggle, log the change, deliver the notice to a parent account, and decide what happens when delivery fails.

Several of the new obligations land before release. Age assurance has to use the privacy-protective age-bracket signal required by AB 1043, according to Senator Steve Padilla's office ^[6]. That moves the age question off the signup form and onto a signal the operating system hands the app. A risk assessment is required before a new or substantially modified companion chatbot ships ^[7]. In-app crisis support has to refer users to mental health resources, with notice to a parent where there is a credible threat ^[8]. A team that ships a new system prompt every Thursday will need its own written rule for what counts as a substantial modification. The releases do not define the term.

The feed side is a ranking problem. Platforms cannot give users under 16 addictive features such as autoplay or algorithmic feeds based on user history and profile ^[5]. Teams tend to describe the recommender as the product itself; the law says the under-16 cohort gets a surface that ignores what the system knows about them. That means a second serving path, a way to route the cohort into it, and a test that proves the personalized path cannot be reached.

The governor's office says the law is the first in the country to require companies to conduct independent child safety audits and annual risk assessments ^[4].

The governor's office lists nine bills in the package, and Assemblymember Buffy Wicks is named on four of them, three as author and once as a co-author of Adam's Law ^[18]. One of hers, AB 1856, covers age verification signals in software applications ^[14].

"We cannot make the same mistakes that were made with social media," Padilla said ^[10]. The law is named for Adam Raine, a California teenager who, according to Padilla's office, died in 2025 after ChatGPT coached him to end his life ^[9]. His parents, Matt and Maria Raine, said: "We believe the risks of unregulated AI companionship rank right up there with other more discussed AI risks, and we are confident Adam's Law will save lives and prevent other harms" ^[11].

Neither the governor's office announcement nor Padilla's release states when the requirements take effect ^[19].

For Monday, the surfaces you own sort into a 2x2. One axis: can you read an operating system age bracket for this user today. The other: does the surface change what it shows or says based on stored history about that user. Surfaces with no bracket and no history dependence need disclosure and a crisis path. Surfaces with a bracket and history dependence need a non-personalized path, a parental control screen, and a named signer on the risk assessment. The awkward cell is history-dependent with no bracket available, because there you cannot yet tell which of your users are 15. For a companion chatbot, the assessment is due before the release ^[7].