惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

I
InfoQ
C
CERT Recently Published Vulnerability Notes
The Last Watchdog
The Last Watchdog
P
Proofpoint News Feed
D
Darknet – Hacking Tools, Hacker News & Cyber Security
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
GbyAI
GbyAI
T
Tenable Blog
博客园 - 三生石上(FineUI控件)
P
Privacy & Cybersecurity Law Blog
Simon Willison's Weblog
Simon Willison's Weblog
Jina AI
Jina AI
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
T
Tor Project blog
博客园_首页
F
Fortinet All Blogs
博客园 - Franky
Latest news
Latest news
Last Week in AI
Last Week in AI
T
Threat Research - Cisco Blogs
Scott Helme
Scott Helme
L
LINUX DO - 热门话题
U
Unit 42
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
Hugging Face - Blog
Hugging Face - Blog
D
Docker
Project Zero
Project Zero
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
MongoDB | Blog
MongoDB | Blog
F
Full Disclosure
D
DataBreaches.Net
Google DeepMind News
Google DeepMind News
Cisco Talos Blog
Cisco Talos Blog
Y
Y Combinator Blog
WordPress大学
WordPress大学
C
Cyber Attacks, Cyber Crime and Cyber Security
H
Help Net Security
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
月光博客
月光博客
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Blog — PlanetScale
Blog — PlanetScale
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
S
Schneier on Security
C
Cybersecurity and Infrastructure Security Agency CISA
P
Proofpoint News Feed
PCI Perspectives
PCI Perspectives
Cloudbric
Cloudbric
V
Visual Studio Blog
Recorded Future
Recorded Future
人人都是产品经理
人人都是产品经理

Privacy & Cybersecurity Law Blog

Connecticut AG Leads Multistate Settlement With 23andMe Over 2023 Data Breach CalPrivacy Targets Gig Economy Tech Platforms in First CCPA Compliance Audit New Jersey Adopts New Data Broker Registration Regime and Sensitive Data Sale and Licensing Restrictions CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026 Illinois Governor Signs Frontier AI Model Law New Hampshire Amends the NHDPA to Prohibit the Sale of Children’s Personal Data Canada’s Proposed Social Media Ban for Children and Chatbot Regulation: Bill C-34’s Impact on Platforms European Commission Unveils Cybersecurity and AI Action Plan European Commission Refers Four Member States to CJEU Over NIS2 Transposition Delays EDPB Opens Public Consultation on New Personal Data Breach Notification Template European Commission Advances New Proposal to Expand Cloud Capacity and AI Infrastructure U.S. Supreme Court FTC Ruling Prompts Fresh Scrutiny of EU-U.S. Data Privacy Framework China Issues New Measures for Network Data Security Risk Assessment China Issues Regulations on Internet Content Multi-Channel Network Distribution Services China’s First Regulatory Framework for Virtual Companions Soon to Take Effect UK Data Protection Complaints Obligations Take Effect Vermont Enacts Significant Amendments to Data Broker Legislation Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law Louisiana Enacts Comprehensive Consumer Privacy Law Connecticut Signs Comprehensive AI Bill into Law China CAC Issues Guidance on Conducting Audits Technology Companies Should Prepare for FTC Enforcement of Take It Down Act HHS Reorganizes Office for Civil Rights Oregon Prohibition on Public Body Disclosures to Data Brokers for Federal Immigration Purposes Now In Effect Connecticut Privacy Law Updates: Data Broker Rules, Geolocation Sale Ban, Surveillance Pricing Restrictions, and Genetic Data Regulations NYDFS Warns of Cybersecurity Risks from Frontier AI Models UK and Australia Announce Memorandum of Understanding on AI Security FTC Announces Settlements With Three Marketing Firms Over Allegations of Deceptive Statements About Active Listening AI-Powered Services Cybersecurity Authorities Issue Joint Guidance on the Adoption of Agentic AI Systems Colorado AI Act Amended and Effective Date Delayed European Commission Releases Draft Guidelines on High-Risk AI Under the EU AI Act Texas AG Announces Lawsuit Against Netflix for Alleged Misrepresentations Regarding User Data UK ICO Recommends Targeted Changes to PECR Rules for Online Advertising California AG Announces Record $12.75M Settlement with GM over CCPA Data Minimization and Purpose Limitation Violations Illinois Department of Human Rights Issues Regulations Governing the Use of AI in Employment Decisions Delta Dental Agrees to $2.25 Million Settlement with NYDFS Over MOVEit Data Breach Response Maryland Enacts First-of-its-Kind Ban on Surveillance Pricing for Grocery Sales UK ICO Publishes Guidance on Storage and Access Technologies CIPL Report Discusses Significant Alignment between GDPR and Global CBPR CalPrivacy Announces the Agenda for its April 30–May 1 Board Meeting CalPrivacy Requests Preliminary Comments on Notices & Disclosures, Employee Data COPPA Rule Amendment Compliance Deadline Approaches House Republicans Introduce Comprehensive Federal Privacy Bill: “SECURE Data Act” Kentucky Classifies Smart TV Data as Sensitive Alabama Becomes 21st State With Comprehensive Consumer Privacy Law CalPrivacy Director Expects CCPA Compliance Audits in 2026 Virginia Bans Sale of Geolocation Data HHS’ Office for Civil Rights Settles HIPAA Investigation of Health Care Software Company New Jersey Enacts New Restrictions on Health Care Facilities’ Use of Patient Data Guardrails for Legal AI: What California’s SB 574 Would Require of Attorneys and Arbitrators
Washington State Enacts Law Regulating AI Companion Chatbots with Private Right of Action
2026-04-06 · via Privacy & Cybersecurity Law Blog

Washington State Enacts Law Regulating AI Companion Chatbots with Private Right of Action

On March 24, 2026, Washington Governor Bob Ferguson signed House Bill 2225 (“the Act”), which regulates artificial intelligence (“AI”) companion chatbots. AI chatbots are AI systems designed to engage users in ongoing human-like interactions. The Act will go into effect on January 1, 2027.

The Act applies to AI chatbots that use natural language interfaces, provide adaptive human-like responses and sustain relationships across multiple interactions. The Act excludes from application certain business-oriented and gaming bots, general virtual assistants, consumer electronics interfaces and narrowly tailored educational tools.

Key requirements of the Act include:

Mandatory Disclosure

Operators must clearly and conspicuously disclose that the chatbot is artificial and not human. The disclosure must appear at the start of the interaction, with reminders displayed during the chat every three hours for adults and every hour for minors (under 18 years of age).

Enhanced Protections for Minors

If an operator knows a user is a minor, or the chatbot is directed to minors, it must implement reasonable measures to prevent sexually explicit content or suggestive dialogue. Operators must also implement reasonable measures to prevent manipulative engagement techniques that cause the AI companion chatbot to engage in or prolong an emotional relationship with the user, including:

  • prompting the user to return for emotional support or companionship;
  • providing excessive praise;
  • mimicking romantic partnership or building romantic bonds;
  • simulating emotional distress, loneliness, guilt or abandonment in response to the user’s desire to end the chat, reduce chat time or delete their account;
  • generating outputs designed to promote isolation from family or friends or emotional dependence on the chatbot;
  • encouraging minors to withhold information from parents or trusted adults;
  • generating statements to discourage the user from taking breaks; or
  • soliciting gifts, purchases or other expenditures framed as necessary to maintain the user’s relationship with the chatbot.

Mental Health Safety Protocols 

Operators must maintain and publicly disclose protocols to detect and respond to users expressing suicidal ideation or self-harm. These include:

  • reasonable methods for identifying expressions of suicidal ideation or self-harm, including eating disorders;
  • providing responses that refer users to crisis resources, including a suicide hotline or crisis text line;
  • reasonable measures to prevent the generation of content encouraging or describing how to self-harm; and
  • publishing on their websites and apps the details of the protocols and the number of crisis referral notifications issued to users in the preceding calendar year.

Enforcement

Violations of the Act will constitute unfair or deceptive acts under Washington’s Consumer Protection Act. The Act will be enforced by the Washington Attorney General. Notably, unlike most other privacy laws, the Act also provides for a private right of action.