Tech & Sourcing @ Morgan Lewis

A teenager opens an app. The feed is personalized based on earlier activity. The next video starts automatically. A companion chatbot remembers yesterday’s conversation. To the user, these may appear to be features of one service. Under a new package of California laws, they are separate design choices that can carry different compliance obligations.

On September 10, 2026, California Governor Gavin Newsom signed a package of 13 child online safety bills, including legislation restricting certain engagement features for users under 16, establishing child-specific requirements for companion chatbots, and expanding potential damages where a social media platform causes injury to a child.

Assembly Bill (AB) 1709 prohibits a “covered platform” from providing an addictive feature to a California user under 16. Addictive features include an addictive feed, autoplay, and any additional features later identified by regulation. A platform may permit an under-16 user to maintain an account so long as the user is not provided those features.

The law also requires providers to use reasonable measures to ensure that users under 16 are not offered addictive features and verify a user’s age under California’s Digital Age Assurance Act prior to providing such features.

Notably, the statutory definition of a covered platform is not limited to services that describe themselves as social media. It can include an online service or application that offers addictive features as a significant part of the service; certain commercial, consumer-review, and cloud-storage services are excluded.

AB 1709 is scheduled to take effect January 1, 2027. Violations may result in penalties of up to $50,000 per affected minor for a knowing violation and $25,000 per affected minor for a negligent violation.

Senate Bill (SB) 1119, known as Adam’s Law, addresses a different part of the online experience: artificial intelligence (AI) systems designed to provide human-like responses, meet a user’s social needs, and sustain a relationship across multiple interactions.

Bots used only for customer service, business operations, productivity, internal research, or technical assistance are generally excluded from this definition.

Beginning July 1, 2027, operators that permit children to use companion chatbots will be required to implement the following measures:

• Pre-deployment risk assessments for new or substantially modified chatbots
• Documented mitigation of identified child-safety risks
• Certain crisis-response protocols
• Parent-controlled default settings and limits on notifications, conversational memory, and usage time
• Restrictions on behavioral advertising and the use or sale of information gathered from children
• Public incident-reporting mechanisms and child-safety policies

The law also establishes independent child-safety audit requirements, requires operators to preserve specified conversation records in certain instances, and creates a private right of action allowing a child harmed by certain violations, or a parent or guardian on the child’s behalf, to sue the operator directly.

Companies providing consumer-facing products and services should review this new legislation and consider conducting a compliance review to assess how the new laws apply to their own features as well as to third-party products and services embedded in such features (e.g., a third-party AI model that controls conversational memory and model behavior within a companion feature).

Where a third-party provider supports a feature within the scope of these laws, the applicable agreement should specify:

• How each party’s role maps to the statutory definitions (e.g., which party is the “operator” of a companion chatbot)
• Which party receives, verifies, and transmits age-related signals
• Who can disable particular features for specified age groups
• What testing and documentation must be completed before launch
• When product, model, or configuration changes require notice, approval, or retesting
• Who must provide records and personnel for audits or regulatory inquiries
• How the parties will investigate incidents, preserve evidence, and implement corrective action

The agreements should also align warranties, indemnities, liability limitations, and insurance requirements with the parties’ operational responsibilities. For example, a provider that controls age-signal processing or conversational memory may be asked to warrant that its component supports the customer’s under-16 and parental-control settings.

The customer, in turn, may retain responsibility for product-level design choices, such as whether to enable autoplay or personalized feeds.

The parties should also consider whether statutory penalties and damages under these laws should be carved out of, or subject to a separate cap under, general liability limitations and whether existing insurance coverage would respond to these types of claims.

That allocation may be particularly important in light of SB 1119’s private right of action and AB 2, which was also enacted as part of the package. AB 2 provides enhanced statutory damages where a social media platform with more than $100 million in annual gross revenue is found to have failed to exercise ordinary care and thereby caused injury to a child.

The available statutory damages are the greater of $5,000 per violation—subject to a $1 million limit per child—or three times the child’s actual damages.

Compliance with these laws is not a one-time exercise: under SB 1119, the risk-assessment requirement applies before a new or substantially modified companion chatbot is made available, and a substantial modification includes a new version, release, or update that materially changes a companion chatbot’s functionality or performance.

AB 1709 also authorizes the California attorney general to identify additional addictive features and adopt rules to enforce AB 1709, including changing the scope of covered platforms.

As such, compliance obligations do not end when a product initially launches. Development and services agreements should require sufficient advance notice of relevant changes (including model updates pushed by an upstream AI provider), establish testing and approval procedures, and allocate responsibility for updating risk assessments, public disclosures, parental controls, and safety measures.