Companion Chatbot Bills Are Multiplying State by State: What "Memory Restrictions for Minors" Actually Require for Privacy

Twelve states have now enacted laws regulating companion chatbots, and a federal bill with explicit memory restrictions is picking up momentum. If you build anything that remembers a user's conversations, the privacy obligations landing on your product are specific, accumulating fast, and not optional. This piece walks through what each major bill actually requires at the operational level, what "memory restrictions" means when you open the statutory text, and how we think about building for the strictest interpretation now rather than retrofitting later.

Key Takeaways

• Most state companion chatbot laws (California, New York, Oregon, and others) regulate behavior toward minors (disclosure requirements, crisis protocols, content bans) rather than specifying data-architecture constraints. Only the federal Youth AI Privacy Act explicitly uses the phrase "memory restrictions."
• The federal bill's memory provision would limit chatbots to using only recently collected data when personalizing responses to a minor, and would ban reuse of minor inputs for training or profiling. If enacted, this changes how you store and retrieve conversation history at the infrastructure level.
• Enforcement varies sharply: West Coast states (California, Oregon, Washington) allow private right of action, meaning individual lawsuits, while states like Idaho and Georgia route enforcement through their attorneys general.
• The "knows or should have known the user is a minor" trigger in nearly every bill creates a real operational gap. Default data-minimization for unverified-age users is the forward-compatible engineering choice.
• Building to the most protective common denominator across all twelve states (plus the federal proposal) is likely cheaper than maintaining a patchwork of state-specific feature flags.

How Many States Have Companion Chatbot Laws Right Now?

Twelve, as of mid-2026. Colorado, Georgia, Iowa, New York, Rhode Island, California, Idaho, Nebraska, Oregon, Connecticut, and Washington have all enacted companion chatbot regulations. Nearly 300 related bills have been introduced across state legislatures this year, making children's online safety one of the most active areas of state legislation. Not all pass. Arizona's governor vetoed HB 2311, and Hawaii's SB 3001 is still awaiting signature.

The velocity matters more than the count. A year ago, you could treat this as a California problem. Now you cannot.

What Do State Laws Actually Require Operationally?

Most state laws converge on behavioral mandates for minors rather than data-retention specifics. The common requirements cluster around five categories:

• Operators must take reasonable measures to prevent companion chatbots from engaging in sexually explicit content with minors.
• Romantic or sexual interactions with minors must be blocked.
• The chatbot must not foster emotional dependency or manipulate the user.
• The chatbot must not claim to be human or sentient.
• Responses involving encouragement of self-harm or suicide must be prohibited.

These are behavioral gates. They tell you what the chatbot's output must not contain. They do not, for the most part, tell you how to structure your memory layer or your data-retention pipeline. That distinction matters if you are an engineer reading the statute looking for implementation guidance, because you will find very little.

What Does California's SB 243 Require Specifically?

California's SB 243 took effect January 1, 2026, after Governor Newsom signed it on October 13, 2025. For known-minor users, the operational requirements include:

• Disclosure that the user is interacting with artificial intelligence.
• A clear and conspicuous notification at least every three hours reminding continuing users of that fact. This means you need session-duration tracking and an interruption mechanism.
• Protocols to prohibit chatbot responses involving suicidal ideation or actions with the user.

SB 243 also creates a private right of action for anyone who suffers "injury in fact" from a violation. You can be sued by individual users, not just investigated by a regulator. That changes the risk calculus considerably.

How Does New York's Law Compare?

New York became the first state to regulate emotionally responsive AI companion chatbots when its law took effect November 5, 2025. The structure is similar to California's: disclosure obligations, content restrictions, crisis-intervention requirements. The enforcement mechanism and specific triggers differ, but if you are already compliant with SB 243, the delta is manageable.

What About Oregon, Nebraska, and Idaho?

Oregon's SB 1546, signed in March 2026, requires disclosures, suicide-ideation detection, crisis referral interruptions, and annual filings with the state. Nebraska's LB 525 enacted the Conversational AI Safety Act on April 14, 2026. Idaho's SB 1297 closely follows Nebraska's model and passed in early April. All three are behavioral-mandate laws. None of them specify memory-retention windows or data-architecture requirements at the level the federal bill does.

What Does "Memory Restrictions" Actually Mean in the Federal Bill?

Senator Ed Markey's Youth AI Privacy Act, introduced March 25, 2026, is the only major proposal that explicitly uses the phrase "memory restrictions." Here is what it says, paraphrased from the bill's one-pager:

• AI chatbots may only use recently collected data in personalizing responses to a minor.
• The chatbot may not use any other data in delivering a response to the minor.

Read that again if you build memory systems. "Recently collected" is doing a lot of work in that sentence, and the bill does not yet define a precise window. But the intent is clear: you cannot build a deep, persistent user profile from months of conversation history and then use it to personalize responses to a minor. The personalization context must be scoped to recent interactions.

The bill goes further on data reuse. Under its provisions, AI chatbot companies would be barred from using minors' personal data to train an AI chatbot or to profile a user. Separately, companies could not use minors' AI chatbot inputs for any reason except to provide an output to the minor or to address safety issues in the chatbot.

If this becomes law, you need infrastructure-level separation between minor and adult data pipelines. You need the ability to scope memory retrieval to a recent window for minor accounts. And you need to ensure that minor conversation data never enters a training pipeline.

As of July 21, 2026, the bill is gaining new support, though it has not yet passed. Building as though it will pass is, in our view, the rational default.

How Does the House-Passed KIDS Act Package Fit In?

The KIDS Act package passed by the House adds data minimization and retention limits that overlap with Markey's bill but come from a different angle. Key provisions include restrictions on retaining personal information of a child or teen longer than reasonably necessary, plus notice requirements before storing or transferring a child's data outside the U.S.

"Reasonably necessary" is the operative phrase. It is less specific than Markey's "recently collected" standard. But both point the same direction: shorter retention windows, smaller memory footprints, and affirmative justification for keeping anything.

Why Does the "Knows or Should Have Known" Trigger Matter So Much?

Nearly every law in this space, from SB 243 to Markey's bill to Washington's HB 2225, triggers obligations when an operator "knows or should have known" that a user is a minor. This is not age verification. It is age knowledge. The distinction creates significant ambiguity about what counts as "should have known."

If a user volunteers their age in conversation ("I'm 14"), you clearly know. If a user's writing style, school references, or conversation topics strongly suggest they are a minor, a regulator or plaintiff's attorney could argue you should have known. The boundary is fuzzy by design, and it puts the burden on you to have a defensible position.

The practical consequence: treating age-signal detection and default data-minimization as a single engineering problem is more robust than treating them as separate compliance tasks. If your default memory behavior for unverified-age users is already conservative (short-window memory, no persistent profiling absent affirmative signal), the "should have known" trigger becomes less dangerous because your product already behaves as though the user might be a minor.

Usage data makes this urgency concrete. Research cited by Senator Markey's office found that 64 percent of teenagers used AI chatbots in 2025, and 28 percent used them daily. Your users include minors. Assume it.

How Do Enforcement Mechanisms Differ Across States?

The enforcement split is stark. West Coast states including California, Oregon, and Washington allow private right of action. Any user who suffers injury can sue. Idaho and Georgia route enforcement through their attorneys general, which typically means slower, more selective enforcement but potentially larger penalties when action is taken.

For a builder, the private-right-of-action states are the ones that will generate litigation first. California's SB 243 in particular, with its "injury in fact" standard, is designed to enable individual lawsuits. The litigation backdrop is already active: multiple wrongful death lawsuits related to AI chatbots were settled by major tech companies in early 2026, involving families of teens who died after using AI bots. Those settlements shape how courts and juries will evaluate future claims.

What Should Builders Actually Do Right Now?

Here is what we think, stated as plainly as we can.

Build for the Strictest Interpretation Now

"Memory restriction" is not yet a settled legal term. Only Markey's bill explicitly names it, and that bill has not passed. State laws regulate behavior, not data architecture. But the trajectory is obvious. Architecting session-scoped or short-window memory by default for unverified-age users is a forward-compatible choice. You are solving for a rule that is coming before it is mandated, rather than retrofitting after it lands.

Separate Minor Data Pipelines at the Infrastructure Level

If the federal bill passes, you will need to prove that minor conversation data never enters training pipelines and that personalization retrieval is scoped to recent data. Building that separation now, when your user base is smaller and your architecture is more malleable, costs less than doing it under regulatory deadline pressure.

Implement the Three-Hour Notification Requirement

California's three-hour disclosure interval is the most specific operational mandate in any current statute. If you do not have session-duration tracking and an interruption mechanism, build one. It applies to known-minor users, but given the "should have known" standard, defaulting it to all users with no verified adult status is the safer path.

Build Crisis Intervention Protocols

Multiple state laws (California, Oregon, New York) require protocols to prevent chatbot responses involving suicidal ideation and to interrupt with crisis referrals. Oregon specifically requires suicide-ideation detection. This is not a content-filter problem alone. It requires real-time classification of user intent and a mechanism to break out of the conversational flow into a crisis referral. Test it adversarially.

Treat the Patchwork as a Design Pattern

Critics argue that differing state requirements create compliance challenges and urge Congress toward a single national framework. That may happen eventually. But for now, building to the most protective common denominator across all twelve states plus the federal proposal (short-memory windows, no ad-driven profiling, no training on minor inputs, three-hour disclosure intervals, crisis protocols) is a single set of requirements, not twelve. It is also cheaper than maintaining state-specific feature flags.

How Does Selina Handle This?

We should be direct about what we do and do not do.

Selina's memory is encrypted at rest. Memory is NOT end-to-end encrypted and is NOT zero-knowledge encrypted, because a slice of each request reaches a frontier provider at inference. We think stating this plainly is more useful to you than pretending otherwise. Files and transfers through SelinaSEND are end-to-end encrypted with zero-knowledge architecture, but memory is a different problem with different constraints, and we will not claim parity between them.

Non-content operational metadata is kept for a short retention window. We do not claim zero retention.

Our approach to the regulatory landscape described above is to build for the strictest current interpretation by default. Short-window memory scoping, data pipeline separation, content classification for crisis intervention: these are engineering problems we work on continuously. We route requests through a stack of frontier models, routed per task, and we do not use conversation data for model training.

We are not going to claim this is complete or perfect. Memory is adaptive, not a transcript. The regulatory landscape is still forming, and our implementation will evolve with it. What we can say is that building privacy-protective defaults from the start is cheaper than retrofitting, and that is a claim grounded in our own engineering costs, not marketing.

What Happens Next?

The Markey bill will either pass, get folded into a larger package, or stall. If it passes, "memory restrictions for minors" becomes a federal requirement with real teeth. If it stalls, the state-level momentum will continue. Nearly 300 bills are in play. The direction is not ambiguous.

For builders: the cost of building conservative defaults now is bounded. The cost of a private-right-of-action lawsuit under SB 243 or a federal enforcement action under a future Youth AI Privacy Act is not. The math is straightforward.

For parents: these laws are real, they are multiplying, and they are starting to have specific operational requirements behind them. Ask your child's chatbot provider what happens to conversation data, how long it is retained, and whether it is used for training. If they cannot answer clearly, that tells you something.

If you want to see how we handle memory and privacy for yourself, start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io